find events NOT in the lookup list?


1 comment

  • Official comment
    Tim MacDonald

    Looking for something that is not there can get a bit tricky. My suggestion would be:

    1. Create a query that creates a list of servers and schedule it to save to an index once every X days/hours. This will create a baseline that can be used later for comparison.


    2. Create a second query that filters the results based on the index created in the first query. This would be accomplished using the subquery operator.

    For example something like this (assuming you saved the first query to an index called "serverlist": 

    |where ! ([subquery:  _sourceCategory="somecategory" 
    | <some logic>
    | count by server
    | fields server | compose server ])

    In the above we are querying the serverlist index, and then filtering out any hosts that do not show up in subquery. 
    This should return only those servers that existed in the baseline index but no longer appear in the current logs. 

    Please note that saving to an index creates additional ingest volume as new data is being generated and saved. 

    Comment actions Permalink

Please sign in to leave a comment.