Hi Splunk Community,
I have a query which has 5eventtypes
index=apple source=Data AccountNo=*
eventType=New York OR
eventType=San Jose| table AccountNo eventType _time
It has to pass eventType=1 to reach it to next stage i.e, eventType=2 so on. Then only we can assume as it's a successful account
Now I wanted to have the query for the unsuccessful accounts meaning..the account does not pass eventtype=1 but it reached to next stages like eventType=2 or eventType=3 so on.
Currently I'm using this query but it's not working
index=apple source=Data AccountNo=* eventType!=1
Do you mean you want to know which accounts don't have all 5 eventTypes?
index=apple source=Data AccountNo=* | stats values(eventType) as eventTypes by AccountNo | where mvcount(eventTypes) != 5
@ITWhisperer : Thanks for your response . I'm looking for which account doesn't passed or doesn't have eventType=Dallas(which is first stage) but went for the next stage like eventType=Houston or eventType=New York etc..
@ITWhisperer : Your query is working, I have a quick question.. what if I also want to exclude type="Houston"
| stats values(type) as types by account | where NOT match(types,"Dallas") OR NOT match(types,"Houston") but it's not working as expected. Can you please advise- Thanks
When using negative conditions you need to use AND rather than OR
| where NOT match(types,"Dallas") AND NOT match(types,"Houston")
Consider a cat - if the condition was not a cat or not a dog it would be true because a cat is not a dog, whereas if the condition was not a cat and not a dog it would be false because while a cat is not a dog, it is a cat.