Splunk Search

Searching for the absence of events

drodman29
Path Finder

I'm looking for an efficient way to find events that have not been indexed. Given a sequentially increasing number (requestId) how can you find missing requestIds in the events:
This search gets me close, but does not find when an entire bin of requestIDs are missing:
index=myindex (requestId > 78815600) AND (requestId < 78915600) | sort 0 +requestId num | bin requestId span=10 | stats count by requestId | where count !=10

Ideally I would be looking for a list of missing requestIds - Thoughts?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=myindex (requestId > 78815600) AND (requestId < 78915600) 
| stats count by requestId
| streamstats current=f window=1 values(requestId) as prev
| eval gap=requestId-prev 
| where gap>1 AND isnotnull(gap)
| eval missing=mvrange(prev+1,requestId)
| table missing
| mvexpand missing

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

index=myindex (requestId > 78815600) AND (requestId < 78915600) 
| stats count by requestId
| streamstats current=f window=1 values(requestId) as prev
| eval gap=requestId-prev 
| where gap>1 AND isnotnull(gap)
| eval missing=mvrange(prev+1,requestId)
| table missing
| mvexpand missing
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...