Splunk Search

How to get fields value which are not matched with other field value?

dhirendra761
Contributor

Hi,

I have 2 searches.

1st query: (100 results including duplicate number)

 

 

index="abc" message.appName=app1 "Description"="After some string*"
| table _time Id number

 

 

2nd query:(80 results including duplicate d_number)

 

 

index="abc" message.appName=app2 "Description"="After some string2*"
| table _time d_Id d_number

 

 

 both d_number number are matching

How to get result-> only those number which are not matched with d_number

I need only 100-80=20 number which may contain duplicate values from 1st query. (eg: query1-query2)

Thank you in advance for your answer.

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

 

What if ids are different but numbers are the same? 

If you only want numbers that are in query 1 but not query 2, then this does it

(index="abc" message.appName=app1 "Description"="After some string*") OR
(index="abc" message.appName=app2 "Description"="After some string2*")
| eval common_number=coalesce(number, d_number)
| stats values("message.appName") as Apps by common_number
| where mvcount(Apps)=1 AND Apps="app1"

 

 

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dhirendra761,

you can try the @bowesmana solution that's correct, but if you need only fields from the first search, you could try an easier solution like this:

index="abc" message.appName=app1 "Description"="After some string*" NOT [ index="abc" message.appName=app2 "Description"="After some string2*" | dedup d_number | rename d_number AS number | fields number ]
| table _time Id number

Ciao.

Giuseppe

0 Karma

bowesmana
SplunkTrust
SplunkTrust

 

What if ids are different but numbers are the same? 

If you only want numbers that are in query 1 but not query 2, then this does it

(index="abc" message.appName=app1 "Description"="After some string*") OR
(index="abc" message.appName=app2 "Description"="After some string2*")
| eval common_number=coalesce(number, d_number)
| stats values("message.appName") as Apps by common_number
| where mvcount(Apps)=1 AND Apps="app1"

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dhirendra761 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...