topic Re: selecting two source files at a time in Getting Data In

selecting two source files at a time

splunkpoornima — Mon, 28 Sep 2020 12:56:40 GMT

Hi all

In the search bar i want to use two source files and to see the events of the two files

below is the query i have used

source="E:\pros_data\taskmanager_log (2).txt" "E:\pros_data\taskmanager_log.txt"

i am getting no results found

please give inputs

Ayn — Tue, 11 Dec 2012 08:19:44 GMT

That is simply incorrect search syntax. You should take the Splunk tutorial to learn the basics, particularly the Start searching section.

yannK — Tue, 25 Dec 2012 19:42:20 GMT

source="sourceA" source="sourceB"

is equivalent to

source="sourceA" AND source="sourceB"

Because your events are very unlikely to be in the sourceA and the sourceB at the same time.

You should use OR instead of AND.

source="sourceA" OR source="sourceB"