Splunk Search

How to get fields value which are not matched with other field value?

dhirendra761
Contributor

Hi,

I have 2 searches.

1st query: (100 results including duplicate number)

 

 

index="abc" message.appName=app1 "Description"="After some string*"
| table _time Id number

 

 

2nd query:(80 results including duplicate d_number)

 

 

index="abc" message.appName=app2 "Description"="After some string2*"
| table _time d_Id d_number

 

 

 both d_number number are matching

How to get result-> only those number which are not matched with d_number

I need only 100-80=20 number which may contain duplicate values from 1st query. (eg: query1-query2)

Thank you in advance for your answer.

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

 

What if ids are different but numbers are the same? 

If you only want numbers that are in query 1 but not query 2, then this does it

(index="abc" message.appName=app1 "Description"="After some string*") OR
(index="abc" message.appName=app2 "Description"="After some string2*")
| eval common_number=coalesce(number, d_number)
| stats values("message.appName") as Apps by common_number
| where mvcount(Apps)=1 AND Apps="app1"

 

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dhirendra761,

you can try the @bowesmana solution that's correct, but if you need only fields from the first search, you could try an easier solution like this:

index="abc" message.appName=app1 "Description"="After some string*" NOT [ index="abc" message.appName=app2 "Description"="After some string2*" | dedup d_number | rename d_number AS number | fields number ]
| table _time Id number

Ciao.

Giuseppe

0 Karma

bowesmana
SplunkTrust
SplunkTrust

 

What if ids are different but numbers are the same? 

If you only want numbers that are in query 1 but not query 2, then this does it

(index="abc" message.appName=app1 "Description"="After some string*") OR
(index="abc" message.appName=app2 "Description"="After some string2*")
| eval common_number=coalesce(number, d_number)
| stats values("message.appName") as Apps by common_number
| where mvcount(Apps)=1 AND Apps="app1"

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dhirendra761 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...