0
votes

I want to filter results of one splunk search from result of second second splunk search

I have two splunk query

index=pool status=OK Detail=Outgoing | table order

A11 A12 A13

index=pool status=OK Detail=Incmoing| table order

A11 A12

I want to filter the results of second search from the search of first search so that i can get result like

A13

1

1 Answers

0
votes

Try this.

index=pool status=OK Detail=Outgoing NOT [search index=pool status=OK Detail=Incoming] | table order