Splunk Search

how search things which do not belong to inner join?

cyberportnoc
Explorer

would like find things which can not inner join, meaning left side and right side which no common things
how search things which do not belong to inner join?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try SPlunk's | set diff command
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Set

| set diff [search yoursearch1 | table somefield] [search yoursearch2 | table somefield]

View solution in original post

0 Karma

somesoni2
Revered Legend

Try SPlunk's | set diff command
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Set

| set diff [search yoursearch1 | table somefield] [search yoursearch2 | table somefield]
0 Karma

cyberportnoc
Explorer

search is very slow when using last 4 hours, parsing job runs at least 3 minutes and still running

source=/var/log/remote/192.168.1.1.log set diff [search "Built inbound" NOT "8.8.8.8" NOT "8.8.4.4" | rex field=_raw "Outside:(?\d+.\d+.\d+.\d+){0,3}" | rex field=_raw "Inside:(?\d+.\d+.\d+.\d+){0,3}"] [search "Built outbound" outsideip=* | rex field=_raw "Outside:(?\d+.\d+.\d+.\d+){0,3}" | rex field=_raw "Inside:(?\d+.\d+.\d+.\d+){0,3}"] | mvexpand destinationip2 | table destinationip2, sourceip2 | stats values(sourceip2) as sourceip2, count by destinationip2 | sort by count by desc | head 10

0 Karma

inventsekar
SplunkTrust
SplunkTrust

maybe, can you give us some example data, so that it will be easy to understand your issue..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...