Splunk Search

results Ids not in list

erick_costa
Path Finder

Hi,

Have a query that results are several Ids (09, 10, 11, 12, 13, ..., 99). I wonder how can I do to know which ids (0 to MaxID = 100) that is not in the result, without using the lookup because Id increasing as it is added to an item.

Tags (1)

DavidHourani
Super Champion

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

DavidHourani
Super Champion

Hey Erick,Could you tell me how you ended up doing this ?

0 Karma

yannK
Splunk Employee
Splunk Employee

This is not an easy question, the lookup or join is probably an easy way to get a list or missing results.

the hard way would be : if you have an event per id, you could sort them per id and use the streamstats or delta function to calculate the difference between each successive id and add a marker (and counter) when something is missing. Then from that list determine the missing ones.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...