https://community.splunk.com/t5/Splunk-Dev/How-can-I-quot-or-quot-with-a-Pivot/m-p/411655#M7149 <P>if it helped please accept the question <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 18 Jan 2019 06:30:51 GMT dkeck 2019-01-18T06:30:51Z https://community.splunk.com/t5/Splunk-Dev/How-can-I-quot-or-quot-with-a-Pivot/m-p/411653#M7147 <P>All, </P> <P>I'd like to alert on process which have Netcat or nmap running for quick notable event. I can get one or the other. But not really both in the single query. I can't seem to find any sort of "OR" for the pivot language. </P> <PRE><CODE>| pivot Application_State Processes values(process) AS "process" SPLITROW dest AS dest FILTER process startsWith nc* </CODE></PRE> <P>Any ideas?</P> Thu, 17 Jan 2019 19:32:52 GMT https://community.splunk.com/t5/Splunk-Dev/How-can-I-quot-or-quot-with-a-Pivot/m-p/411653#M7147 daniel333 2019-01-17T19:32:52Z https://community.splunk.com/t5/Splunk-Dev/How-can-I-quot-or-quot-with-a-Pivot/m-p/411654#M7148 <P>Hi,</P> <P>maybe a look at this could help you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P><A href="https://answers.splunk.com/answers/547909/how-to-filter-multiple-values-with-pivot-command-i.html">https://answers.splunk.com/answers/547909/how-to-filter-multiple-values-with-pivot-command-i.html</A></P> Thu, 17 Jan 2019 19:43:16 GMT https://community.splunk.com/t5/Splunk-Dev/How-can-I-quot-or-quot-with-a-Pivot/m-p/411654#M7148 dkeck 2019-01-17T19:43:16Z https://community.splunk.com/t5/Splunk-Dev/How-can-I-quot-or-quot-with-a-Pivot/m-p/411655#M7149 <P>if it helped please accept the question <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 18 Jan 2019 06:30:51 GMT https://community.splunk.com/t5/Splunk-Dev/How-can-I-quot-or-quot-with-a-Pivot/m-p/411655#M7149 dkeck 2019-01-18T06:30:51Z