Splunk Search

Subsearch: How can we only see results when they are NOT found?

Explorer

I running a subsearch where i use a ID to find events from the index B in the index A.

What I want to do is: list the ID's from the index B that was not found in the index A

The subsearch structure is : search index=A search index=B |table ID's

How can I list the ID's that wasn't found?

0 Karma
1 Solution

Esteemed Legend

Skip the subsearch and do this:

index="A" OR index="B"
| stats dc(index) AS indexCount values(index) AS index BY ID
| where index="B" AND indexCount=1

View solution in original post

0 Karma

Esteemed Legend

Skip the subsearch and do this:

index="A" OR index="B"
| stats dc(index) AS indexCount values(index) AS index BY ID
| where index="B" AND indexCount=1

View solution in original post

0 Karma

Influencer

You need to use NOT.

index=A NOT [search index=B | table ID's]
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!