Splunk Search

results Ids not in list

erick_costa
Path Finder

Hi,

Have a query that results are several Ids (09, 10, 11, 12, 13, ..., 99). I wonder how can I do to know which ids (0 to MaxID = 100) that is not in the result, without using the lookup because Id increasing as it is added to an item.

Tags (1)

DavidHourani
Super Champion

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

DavidHourani
Super Champion

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

yannK
Splunk Employee
Splunk Employee

This is not an easy question, the lookup or join is probably an easy way to get a list or missing results.

the hard way would be : if you have an event per id, you could sort them per id and use the streamstats or delta function to calculate the difference between each successive id and add a marker (and counter) when something is missing. Then from that list determine the missing ones.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...