topic Re: How to search for multiple fields in a source files? in Getting Data In

How to search for multiple fields in a source files?

npestana88 — Wed, 22 Apr 2015 16:01:13 GMT

So I have a set of source files that list different fields as separate events and I would like to search for source files that have the specified field values. However when I search for multiple fields (eg. diameter=30 AND temp=77) it doesn't return any results since the fields are contained in different events. Is there a way around it? All I need are the names of the source files.
Sorry if this is an obvious question, I'm still new at this

Re: How to search for multiple fields in a source files?

stephanefotso — Wed, 22 Apr 2015 16:18:38 GMT

Hello! Try.

.....source=firstsourcefile OR source=secondsourcefile (diameter=30 AND temp=77)|......

Re: How to search for multiple fields in a source files?

npestana88 — Wed, 22 Apr 2015 16:40:10 GMT

Hi thanks for the response, what I'm trying to do is look through a lot of source files so I can't exactly type in all of the names of the file, it there a way to scan all source files in the index?

Re: How to search for multiple fields in a source files?

stephanefotso — Wed, 22 Apr 2015 17:10:56 GMT

ok let suppose that your souce name is mysource/poooo/jjjjjjj/yyyyyyy/............./ or yyyyyyyyyy/second/........

you can use the star(*) symbol to match any caracter in your source field. Something like this

source=mysource* OR source=*second* (diameter=30 AND temp=77)|...

Re: How to search for multiple fields in a source files?

hcbomb — Wed, 22 Apr 2015 22:37:25 GMT

To paraphrase, it sounds like you're trying to search for particular events to generate a list of sources. From this curated list, search for a different type of events, right?

If so, make yourself familiar with sub-searches:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

Also, what precisely are you trying to look for that should belong to the first group of sources vs. what should be found from the other?

Your structure would basically look like this:

Subsearch query for the events:

source= diameter=X

Filter this to specifically the sources:

source= diameter=X | fields
source

Insert into a different search, which includes the other field:

( [search source= diameter=X
| fields source ]) temp=Y

Now you have all events that fit temp=Y but only if that source has events that match diameter=X. Let me know if that works!