https://community.splunk.com/t5/Splunk-Search/Help-with-Boolean-query/m-p/557636#M158368 <P>Below is an example of what I want to accomplish:</P><P>&nbsp;</P><P>If x="example" and y="success", return true for this segment.&nbsp;</P><P>If x="example2" and y="success", return true for this segment.</P><P>If x="example3" and y="success", return true for this segment.</P><P>If all are three statements = true, return true. If not all three = true, return false.</P><P>&nbsp;</P> Tue, 29 Jun 2021 16:07:32 GMT TheBravoSierra 2021-06-29T16:07:32Z https://community.splunk.com/t5/Splunk-Search/Help-with-Boolean-query/m-p/557636#M158368 <P>Below is an example of what I want to accomplish:</P><P>&nbsp;</P><P>If x="example" and y="success", return true for this segment.&nbsp;</P><P>If x="example2" and y="success", return true for this segment.</P><P>If x="example3" and y="success", return true for this segment.</P><P>If all are three statements = true, return true. If not all three = true, return false.</P><P>&nbsp;</P> Tue, 29 Jun 2021 16:07:32 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Boolean-query/m-p/557636#M158368 TheBravoSierra 2021-06-29T16:07:32Z https://community.splunk.com/t5/Splunk-Search/Help-with-Boolean-query/m-p/557637#M158369 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/230424">@TheBravoSierra</a>&nbsp;</P><P>Are you looking for this?</P><LI-CODE lang="markup">YOUR_SEARCH | eval flag=if((x="example" OR x="example2" OR x="example3") and y="success", "true", "false")</LI-CODE><P>&nbsp;</P><P><STRONG>My Sample Search :</STRONG></P><LI-CODE lang="markup">| makeresults | eval x="example",y="success" |append [| makeresults | eval x="example2",y="failed" ] | eval flag=if((x="example" OR x="example2" OR x="example3") and y="success", "true", "false")</LI-CODE><P><BR />&nbsp;</P> Tue, 29 Jun 2021 16:16:29 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-Boolean-query/m-p/557637#M158369 kamlesh_vaghela 2021-06-29T16:16:29Z