Splunk Search

Two sets subtraction

pitmod
Explorer

I have a two saved searches A and B. Each gives an output like below:

A:                             

host

host1

host2

host 3

B:

host

host 2

host 3

host 4

I'd like to execute search that uses results of both saved searches to perform set subtraction: A - B. So in this example I should get host1 as an result. The number of hosts for A and B can be greater than 10000 so I'd like to avoid using subsearch command as my output could be truncated.

Labels (1)
0 Karma
1 Solution

ITWhisperer
Legend

There are probably a number of ways to do this - try:

searchA
| eval search="A"
| append [searchB
          | eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"

View solution in original post

ITWhisperer
Legend

There are probably a number of ways to do this - try:

searchA
| eval search="A"
| append [searchB
          | eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!