CODEWITHSUNDEEP
splunksplunk-query
Gaurav Agrahari
Gaurav Agrahari

Reputation: 29

How to filter data of one splunk search from another splunk search

I want to filter results of one splunk search from result of second second splunk search

I have two splunk query

index=pool status=OK Detail=Outgoing | table order

A11 A12 A13

index=pool status=OK Detail=Incmoing| table order

A11 A12

I want to filter the results of second search from the search of first search so that i can get result like

A13

Upvotes: 0

Views: 839

Answers (1)

RichG
RichG

Reputation: 9926

Try this.

index=pool status=OK Detail=Outgoing NOT [search index=pool status=OK Detail=Incoming] | table order

Upvotes: 0

Related Questions