Splunk Search

What are Splunk search rules for hit by count?

bam22
Engager

In the below search I am looking for rules hit by count, but how or where would I add a NOT or !, if I wanted to know what rules have not be hit.

index=pan_logs | fields _time, rule | stats count by rule | sort -count

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does PAN log rules that are not hit?  I suspect not, but if it does then you'll have to modify your search to find those events.

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...