Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do you search for event types that return no results?

$
0
0
I have a list of event types I'm searching for based on a standard naming convention. I want to be able to return a list of event types that have not occurred in the given time frame. Right now, my search looks something like this: eventtype=ps-* And then from there, I am working with the list of returned events. I need a separate search to get a list of the event types that didn't return anything. Thoughts?

Viewing all articles
Browse latest Browse all 47296

Trending Articles