Splunk Search

search query help

shri_27
Path Finder

Hi all,
I have 2 files, where suplierID,contractID are the common fields, Now I want to exclude the values of these fieds from 1st file if the value pair is present in 2nd file.how to achieve this??
plese help me for this.

Thanks in advance

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

source=file1 NOT [search source=file2 | fields + suplierID contractID]

The subsearch gets executed first and returns the key/value pairs for the the two fields in question and then the outer search gets executed like so;

source=file1 NOT (( suplierID=X AND contractID=Y ) OR ( suplierID=X AND contractID=Z ) OR ... )

/K

Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...