Splunk Search

help for displaying events that have collected in one index but never in other

jip31
Motivator

hi
I tried to find host from my csv file which have connected in one specific index but never in others
I have done the search below but its what i need because it just exclude events from others indexes
how to do this please??

 index="tutu*" 
| search NOT (index="toto*" OR index="tata*" OR index="titi*") 
    [| inputlookup host.csv 
    | table host] 
| dedup host 
| table host
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi jip31,
try something like this:

(index="tutu*" OR index="toto*" OR index="tata*" OR index="titi*") [| inputlookup host.csv | table host] 
| stats values(index) AS index count BY host
| eval check=if(index="tutu*","only toto","also others")
| search check="only toto"
| table host

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi jip31,
try something like this:

(index="tutu*" OR index="toto*" OR index="tata*" OR index="titi*") [| inputlookup host.csv | table host] 
| stats values(index) AS index count BY host
| eval check=if(index="tutu*","only toto","also others")
| search check="only toto"
| table host

Ciao.
Giuseppe

0 Karma

jip31
Motivator

perfect thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...