topic one of the field value showing results which didn't search in Splunk Cloud Platform

one of the field value showing results which didn't search

senthild — Tue, 02 Jan 2024 18:36:15 GMT

one for the search query from splunk AWS

index="aws_cloud" | search eventname="value1" OR "value2" OR "value3"

The above search query is giving the events for the all the above searched one also giving one more value which didn't searched

eventName: LookupEvents ==> getting this field and value which didn't search

Re: one of the field value showing results which didn't search

dtburrows3 — Tue, 02 Jan 2024 18:47:28 GMT

try this instead

index="aws_cloud" eventName IN ("value1", "value2", "value3")

I believe the format you posted is searching eventName="value1" OR any raw log containing the strings "value2" OR "value3" even if "value2" OR "value3" isn't the actual value of eventName for that particular event.