topic Re: Multiple searches on the same field? in Splunk Search

Multiple searches on the same field?

whucks — Fri, 18 Mar 2011 01:18:43 GMT

Is it possible to perform multiple searches on the same field? For reporting purposes I want to search for all values less than zero, equal to zero, and greater than zero.

Re: Multiple searches on the same field?

dwaddle — Fri, 18 Mar 2011 01:50:36 GMT

Sure.. just use OR

my awesome search terms AND ( foo=0 OR foo>200 OR foo <5 )

Now, if you're wanting to do some distribution analysis, it might be more like

my awesome search terms | eval disposition=case(foo < 0, "Lessthanzero", 
foo=0 , "EqualZero", 
foo > 0, "GreaterThanZero") 
| stats count(_raw) by disposition

Re: Multiple searches on the same field?

whucks — Fri, 18 Mar 2011 01:59:45 GMT

Thank you very much for your answer to my question. Your solution worked perfectly.

Re: Multiple searches on the same field?

rps462 — Sun, 19 May 2013 18:04:36 GMT

If this isn't working for you .. it's ok, you're not crazy. Chances are you have "or" instead of "OR". Make sure it's capitalized.