Splunk Search

Splunk query to filter the results

iamsplunker
Path Finder

Hi Splunk Community, 

I have a query which has 5eventtypes 

index=apple source=Data AccountNo=*

eventType=DallasOR 

eventType=Houston OR

eventType=New York OR 

eventType=Boston OR 

eventType=San Jose| table AccountNo eventType _time

It has to pass eventType=1 to reach it to next stage i.e, eventType=2 so on. Then only we can assume as it's a successful account

Now I wanted to have the query for the unsuccessful accounts meaning..the account does not pass  eventtype=1 but it reached to next stages like eventType=2 or eventType=3 so on.

--

Currently I'm using this query but it's not working 

index=apple source=Data AccountNo=*  eventType!=1

Please help

Labels (3)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(type) as types by account
| where NOT match(types,"Dallas")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean you want to know which accounts don't have all 5 eventTypes?

index=apple source=Data AccountNo=* 
| stats values(eventType) as eventTypes by AccountNo
| where mvcount(eventTypes) != 5
0 Karma

iamsplunker
Path Finder

@ITWhisperer : Thanks for your response . I'm looking for which account doesn't passed or doesn't have eventType=Dallas(which is first stage) but went for the next stage like eventType=Houston or eventType=New York etc..

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats values(type) as types by account
| where NOT match(types,"Dallas")
0 Karma

iamsplunker
Path Finder

@ITWhisperer : Your query is working, I have a quick question.. what if I also want to exclude type="Houston"

I've tried 

| stats values(type) as types by account
| where NOT match(types,"Dallas") OR NOT match(types,"Houston")

but it's not working as expected. Can you please advise- Thanks
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

When using negative conditions you need to use AND rather than OR

| where NOT match(types,"Dallas") AND NOT match(types,"Houston")

 Consider a cat - if the condition was not a cat or not a dog it would be true because a cat is not a dog, whereas if the condition was not a cat and not a dog it would be false because while a cat is not a dog, it is a cat.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...