topic How to add 2-3 fields in single query in Dashboards & Visualizations

How to add 2-3 fields in single query

aditsss — Thu, 25 Mar 2021 15:00:12 GMT

Hi Everyone,

I have one requirement.

I have two queries like this:

index=abc ns=sidh-datagraph3 "NullPointerException"

index=abc ns=sidh-datagraph3 "IllegalStateException"

I want to combine it in a same query.

Can someone guide me on this.

Thanks in advance

isoutamo — Fri, 26 Mar 2021 06:52:46 GMT

You should try

index=abc ns=sidh-datagraph3 ("NullPointerException" OR "IllegalStateException")

(fixed)

r. Ismo

s2_splunk — Thu, 25 Mar 2021 18:38:18 GMT

You probably want parenthesis in there:

index=abc ns=sidh-datagraph3 ("NullPointerException" OR "IllegalStateException")