topic Re: How to use multiple AND & OR condition? in Monitoring Splunk

How to use multiple AND & OR condition?

fivesevenfeeeet — Fri, 13 Jan 2023 10:20:38 GMT

Hello, I'm looking to create a query that helps to search the following conditions.

For example, get the address for

1. John from Spain

2. Jane from London

3. Terry from France

My current methodology is to run each query one by one for each examples.

index IN ( sampleIndex)
John AND Spain
| stats name, country, address

After running the above query, I run for the next example.
index IN ( sampleIndex)
Jane AND London
| stats name, country, address

Running 1 query for 1 example will become tedious if I have thousand of examples to go through.

It is possible to get some help on creating query that help to run similar logic like the following,

index IN ( sampleIndex)
Jane AND London OR
John AND Spain OR
Terry AND France
| stats name, country, address

Sorry if my question isn't clear.

Re: How to use multiple AND & OR condition?

gcusello — Fri, 13 Jan 2023 10:48:21 GMT

Hi @fivesevenfeeeet,

you can use parenthesis in boolean conditions to define rules:

index IN (sampleIndex) ((Jane London) OR (John Spain) OR (Terry France)) | stats name, country, address

the AND condition isn't mandatory in searches (it's mandatory in eval).

Ciao.

Giuseppe

Re: How to use multiple AND & OR condition?

fivesevenfeeeet — Fri, 13 Jan 2023 14:47:11 GMT

Life saver, thank you 🙂