Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Subsearch NOT in

$
0
0

I have two sourcetypes A and B - each has a column SERIAL_NUMBER

Sourcetype A has over 1000,000 records Sourcetype B has over 15,000 records

I need every SERIAL_NUMBER in sourcetype A that is NOT present in sourcetype B - SO - I write a subsearch and insert a NOT in there - like SO :

sourcetype="A" SERIAL_NUMBER= * | search NOT [ search sourcetype="B" SERIAL_NUMBER= * | fields + SERIAL_NUMBER] | dedup SERIAL_NUMBER | table SERIAL_NUMBER

Is there a better way to create this query ?

I tried doing an outer join but that did not work out well


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>