DBX将两个数据库连接在一起并过滤出结果

时间:2019-01-04 09:52:06

标签: join splunk dbx

我可以这样写搜索:

| dbquery "DB1" "SELECT A.* AOS.* FROM Assets A JOIN AssetOSs AOS ON A.AssetOSID = AOS.AssetOSID" | append [ dbquery "DB2" "SELECT DB1A.IPAddressStr DB2M.User FROM DB1.Assets DB1A JOIN DB2.Machines DB2M ON DB1A.IPAddressStr = DB2M.IP" 

上面的查询将DB1和DB2的结果结合在一起

但是我将如何执行dbquery从DB1结果中排除DB2的结果

例如:

DB1结果:A,B,C,D DB2结果:C,D

由于C和D存在DB2结果,所以我想在DB1结果中排除它们,并在最终结果中仅获得A,B

任何帮助都会很棒

1 个答案:

答案 0 :(得分:0)

尝试此未经测试的查询。

| dbquery "DB1" "SELECT A.* AOS.* FROM Assets A JOIN AssetOSs AOS ON A.AssetOSID = AOS.AssetOSID" 
| search NOT [ dbquery "DB2" "SELECT DB1A.IPAddressStr DB2M.User FROM DB1.Assets DB1A JOIN DB2.Machines DB2M ON DB1A.IPAddressStr = DB2M.IP"]