Splunk Search

Two sets subtraction

pitmod
Explorer

I have a two saved searches A and B. Each gives an output like below:

A:                             

host

host1

host2

host 3

B:

host

host 2

host 3

host 4

I'd like to execute search that uses results of both saved searches to perform set subtraction: A - B. So in this example I should get host1 as an result. The number of hosts for A and B can be greater than 10000 so I'd like to avoid using subsearch command as my output could be truncated.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

There are probably a number of ways to do this - try:

searchA
| eval search="A"
| append [searchB
          | eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There are probably a number of ways to do this - try:

searchA
| eval search="A"
| append [searchB
          | eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...