Splunk Search

Return results that are in Index1 and NOT in Index2

tristanmatthews
Path Finder

I have two indexes one contains objects of interest and things I don't care about, all_results, and the other is a list of things I know I don't care about, bad_results, I want to return elements of the first list that don't exist in the second. I was able to make it working by using.

Is there a simpler / better way to do this then something like:

index=all_results OR index=bad_results | eval isBad=if(index="bad_results", key, 0) | where key!=isBad | transaction key maxspan=1d maxevents=-1

Thanks

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
index=all_results NOT [ search index=bad_results | return 10000 key ] 

if you have 10000 or fewer distinct keys in bad_results or:

index=all_results OR index=bad_results | stats count(eval(index=="bad_results")) as b by key | where b<1 

doesn't appear simpler than yours, but it runs better if you have a multi-node Splunk system. on the other hand, it doesn't return the whole item, just the key, though you can fix that by adding first(otherfield) as otherfield to the stats command.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee
index=all_results NOT [ search index=bad_results | return 10000 key ] 

if you have 10000 or fewer distinct keys in bad_results or:

index=all_results OR index=bad_results | stats count(eval(index=="bad_results")) as b by key | where b<1 

doesn't appear simpler than yours, but it runs better if you have a multi-node Splunk system. on the other hand, it doesn't return the whole item, just the key, though you can fix that by adding first(otherfield) as otherfield to the stats command.

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...