Splunk Search

results Ids not in list

erick_costa
Path Finder

Hi,

Have a query that results are several Ids (09, 10, 11, 12, 13, ..., 99). I wonder how can I do to know which ids (0 to MaxID = 100) that is not in the result, without using the lookup because Id increasing as it is added to an item.

Tags (1)

DavidHourani
Super Champion

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

DavidHourani
Super Champion

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

yannK
Splunk Employee
Splunk Employee

This is not an easy question, the lookup or join is probably an easy way to get a list or missing results.

the hard way would be : if you have an event per id, you could sort them per id and use the streamstats or delta function to calculate the difference between each successive id and add a marker (and counter) when something is missing. Then from that list determine the missing ones.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...