Splunk Search

results Ids not in list

erick_costa
Path Finder

Hi,

Have a query that results are several Ids (09, 10, 11, 12, 13, ..., 99). I wonder how can I do to know which ids (0 to MaxID = 100) that is not in the result, without using the lookup because Id increasing as it is added to an item.

Tags (1)

DavidHourani
Super Champion

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

DavidHourani
Super Champion

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

yannK
Splunk Employee
Splunk Employee

This is not an easy question, the lookup or join is probably an easy way to get a list or missing results.

the hard way would be : if you have an event per id, you could sort them per id and use the streamstats or delta function to calculate the difference between each successive id and add a marker (and counter) when something is missing. Then from that list determine the missing ones.

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...