Splunk Search

Set difference between two output of two query

Nilesh067
Explorer

I have two query i want to get those result that are in query 1 but not in query 2

Query 1 :

index=APP_SERVER- source=API_LOG "Error while create record for customer id*" |rex "customer id : (?<custId>.*\w+)" |dedup custId |table custId

Output :

94ABGH0048

902SDKK557

902SGHT224

902SLWT720

 

Query 2 :

index=APP_SERVER- source=API_LOGS  "Successfully created record for customer id*" |rex "customer id : (?<custId>.*\w+)" |dedup custId |table custId

Output :

945TTFK0548

94ABGH0048

902SLWT720

 

I want below output out of both query ,it means these id are in query 1 result but not in query 2 result

 

902SDKK557

902SGHT224

Labels (6)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This should do it.

 

index=APP_SERVER- source=API_LOG "Error while create record for customer id*" 
| rex "customer id : (?<custId>.*\w+)" 
| search NOT [search index=APP_SERVER- source=API_LOGS  "Successfully created record for customer id*" |rex "customer id : (?<custId>.*\w+)" | return custId]
| dedup custId 
| table custId 

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Nilesh067
Explorer

@richgalloway 
it is showing, Unknown search command 'index'.

0 Karma

richgalloway
SplunkTrust
SplunkTrust
I've corrected my reply.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...