topic Re: Grouping multiple OR values in Splunk Search

Grouping multiple OR values

babakkhorshid — Mon, 02 Sep 2019 12:33:14 GMT

Hi People,
Is there any efficient way of grouping values?
I have like 20 Or statement that I need to match
something like
("x" OR "Y" OR "Z" OR "A" OR "B" OR "C")

Is there any expression like
any of (x,y,z,a,b,c) ?

Re: Grouping multiple OR values

renjith_nair — Mon, 02 Sep 2019 13:42:34 GMT

@babakkhorshid,

Try,

field_name IN(x,y,z,a,b,c)

Reference : Multiple field-value comparisons with the IN operator

Re: Grouping multiple OR values

babakkhorshid — Tue, 03 Sep 2019 00:18:44 GMT

Thanks Renjith

I think this would solve my issue.

But out of interest:
What if the field_Name is not the same.

Like we have Multiple events (like Phrases or words we need to match) in multiple fields?

example: "200" "201" "202" "203" "204" in fields A, B and C

Much appreciate your help and Thanks

Re: Grouping multiple OR values

renjith_nair — Tue, 03 Sep 2019 13:10:35 GMT

@babakkhorshid ,
Thanks. Please accept as answer if it's working for you.

For handling different field name, you may use field alias and use the alias in search as described in https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Addaliasestofields