Splunk Search

Two sets subtraction

pitmod
Explorer

I have a two saved searches A and B. Each gives an output like below:

A:                             

host

host1

host2

host 3

B:

host

host 2

host 3

host 4

I'd like to execute search that uses results of both saved searches to perform set subtraction: A - B. So in this example I should get host1 as an result. The number of hosts for A and B can be greater than 10000 so I'd like to avoid using subsearch command as my output could be truncated.

Labels (1)
0 Karma
1 Solution

ITWhisperer
Legend

There are probably a number of ways to do this - try:

searchA
| eval search="A"
| append [searchB
          | eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"

View solution in original post

ITWhisperer
Legend

There are probably a number of ways to do this - try:

searchA
| eval search="A"
| append [searchB
          | eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.