Splunk Search
Highlighted

Subsearch: How can we only see results when they are NOT found?

Engager

I running a subsearch where i use a ID to find events from the index B in the index A.

What I want to do is: list the ID's from the index B that was not found in the index A

The subsearch structure is : search index=A search index=B |table ID's

How can I list the ID's that wasn't found?

0 Karma
Highlighted

Re: Subsearch: How can we only see results when they are NOT found?

Influencer

You need to use NOT.

index=A NOT [search index=B | table ID's]
0 Karma
Highlighted

Re: Subsearch: How can we only see results when they are NOT found?

Esteemed Legend

Skip the subsearch and do this:

index="A" OR index="B"
| stats dc(index) AS indexCount values(index) AS index BY ID
| where index="B" AND indexCount=1

View solution in original post

0 Karma