How to add two filter criteria in one search query

aditsss — Mon, 05 Oct 2020 11:34:04 GMT

Hi Everyone,

I have two search queries with two filter criteria's

1st query:

index=abc ns=xyz app_name=sd "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count, by sourceagent,RID
| rename sourceagent as "Source"|fields RID Source

2nd query

index=abc ns=xyz app_name=sd"ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count, by sourceagent,RID
| rename sourceagent as "Source"|fields RID Source

Since the search is same for both only the filter criteria is different like "ARC EVENT RECEIVED FROM SOURCE" and "ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF".

How can I make it a single query with two filter criteria.

Can someone guide me on that.

Re: How to add two filter criteria in one search query

ITWhisperer — Mon, 05 Oct 2020 12:11:35 GMT

index=abc ns=xyz app_name=sd "ARC EVENT RECEIVED FROM SOURCE" OR "ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)" | stats count, by sourceagent,RID | rename sourceagent as "Source"|fields RID Source

topic Re: How to add two filter criteria in one search query in Dashboards & Visualizations

How to add two filter criteria in one search query

Re: How to add two filter criteria in one search query