Splunk Search

Subsearch 2 fields with Match and 1 mismatch

rsharma1984
Explorer

index =ttt beforeController [search index = ttt beforeController | fields pnr, bnr, NOT(gnr)]

How can I achieve that? I am trying to subsearch same types of transactions where 2 fields needs to match exactly(pnr, bnr) but 3 one should not match(gnr).

Example:

Suppose there are 3 transactions:
1. http://cdn.xxx.yy.com/pnr=PAA&bnr=BAA&gnr=GAA&class=A]
2. http://cdn.xxx.yy.com/pnr=PAA&bnr=BAA&gnr=GAA&class=B]
3. http://cdn.xxx.yy.com/pnr=PAA&bnr=BAA&gnr=GAA2&class=c]

So here I want the transactions matching 1 and 3 or 2 and 3, where pnr and bnr should match but not gnr.

Tags (1)
0 Karma

somesoni2
Revered Legend

Why not just use dedup command with all three fields so that any duplicates will be removed.

0 Karma

jplumsdaine22
Influencer

I still don't understand you. You want events 1 & 3, but 1 &2 are identical in your example

0 Karma

rsharma1984
Explorer

so basically I don't want duplicates, so you can say (1 and 3) or (2 and 3).
Not to mention timestamp for these 3 events are different.

0 Karma

jplumsdaine22
Influencer

I assume you mean you have three fields, pnr, bnr, and gnr. You want to find events where gnr is null.

index=ttt beforeController pnr=* bnr=* | where isnull(gnr)

If that's not what you're trying to do can you provide som sample events and an example of what you want the result to be?

rsharma1984
Explorer

I have updated the question with example. Let me know if that helps in understanding it better.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...