Splunk Search

results Ids not in list

Path Finder

Hi,

Have a query that results are several Ids (09, 10, 11, 12, 13, ..., 99). I wonder how can I do to know which ids (0 to MaxID = 100) that is not in the result, without using the lookup because Id increasing as it is added to an item.

Tags (1)

SplunkTrust
SplunkTrust

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

SplunkTrust
SplunkTrust

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

Splunk Employee
Splunk Employee

This is not an easy question, the lookup or join is probably an easy way to get a list or missing results.

the hard way would be : if you have an event per id, you could sort them per id and use the streamstats or delta function to calculate the difference between each successive id and add a marker (and counter) when something is missing. Then from that list determine the missing ones.

0 Karma