Splunk Search

splunk query with specific product id count

freephoneid
Path Finder

Hi,

My log contains below entries:

activated=true productid=8432 userid=123 email=abc@abc.com
activated=false productid=8432 userid=2123 email=12@a212bc.com
activated=true productid=3422 userid=434123 email=pqe@dfd.com
activated=true productid=433232 userid=7468 email=434@a43433c.com

I want to find the count for all those users who have activated=true and whose productids are not 645,423,433232,7483,57893,45673,847832,48832,4323,432,3323,323,12,233,234545,2323

Can any one provide me the query for the same?

Thanks

Tags (3)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count

View solution in original post

0 Karma

gooza
Communicator

use lookup tables , list the product id you're looking for in csv and add a seen field to it:

productid,seen

645,1

423,1
and so on

then run the search

activated=true | lookup yourlookuptable productid OUTPUT seen | Where seen!=1

you can read more on lookup tables at:

docs.splunk.com

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
activated=true NOT productid=645 NOT productid=423 NOT productid=433232 NOT productid=7483 ... | stats count
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

if you look at gooza's answer, you can do it with a lookup table. it's actually better (much better) with a subsearch and a lookup definedd like he has, and then doing:

activated=true NOT [ inputlookup yourlookuptable | return 10000 productid ] | stats count

which will work with up to 10000 productids.

0 Karma

freephoneid
Path Finder

Hi gkanapathy....The product id list is more than 30...Is there another way to implement this query?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...