Splunk Search

What are Splunk search rules for hit by count?

bam22
Engager

In the below search I am looking for rules hit by count, but how or where would I add a NOT or !, if I wanted to know what rules have not be hit.

index=pan_logs | fields _time, rule | stats count by rule | sort -count

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Does PAN log rules that are not hit?  I suspect not, but if it does then you'll have to modify your search to find those events.

Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...