Splunk Search

Result that does not match an item in list

vschrodda
Explorer

 

With a search I would like a result that does NOT match an element in a list

For instance:

 

 

 

index=myindex source="mysource_*" earliest-30m

 

 

 

I'd like to compare the sources against a list, such as:

 

 

 

("*one","*two","*three")

 

 

 

If the search results, for instance, DON'T include events with the source "mysource_three" I would like a result that states this.  Ultimately, I'm looking to create an alert based on the query; if there are no events seen from some sources in the last 30 minutes.

Labels (2)
0 Karma
1 Solution

vschrodda
Explorer

Figured out what I needed

index=myindex source="mysource_*" earliest=-30m | stats count by source | table source | eval Found=1 | append [|inputlookup mylookup_table.csv | table source | eval Found=0] | stats max(Found) as Found by source | where Found=0

View solution in original post

vschrodda
Explorer

Figured out what I needed

index=myindex source="mysource_*" earliest=-30m | stats count by source | table source | eval Found=1 | append [|inputlookup mylookup_table.csv | table source | eval Found=0] | stats max(Found) as Found by source | where Found=0

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

index=myindex source="mysource_*" earliest-30m
| regex source!="mysource_(?:one|two|three)"

If you get any results, then trigger an alert.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vschrodda
Explorer

This results in a 'source' that did not match an element in the list.  I can do this without issue.  I'm trying to determine which element(s) did not have any matching events (there would be no matching events in the last 30 minutes)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I got lost with all the negatives in that.  What problem are you trying to solve?

---
If this reply helps you, Karma would be appreciated.
0 Karma

vschrodda
Explorer

I'm simply trying to determine/list any elements ("*one","*two","*three")  did not have any matching events in given time frame

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...