topic search query filter in Splunk Search

search query filter

ringbbg — Tue, 01 Aug 2017 00:34:26 GMT

I have a simple search query to look for vpn alerts

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="*karachi*" KMD_PM_SA_ESTABLISHED OR "IKE negotiation failed with error"

However, I want to make splunk return results of KMD_PM_SA_ESTABLISHED only when the IKE negotiation failed with error is detected beforehand. Is there a way to do it?

Thanks

Re: search query filter

niketn — Tue, 01 Aug 2017 02:08:07 GMT

Change OR to AND, which will match both conditions to be true. Even if you take out OR, by default Splunk will use AND.

Re: search query filter

inventsekar — Tue, 29 Sep 2020 15:10:40 GMT

>  I want to make splunk return results
> of KMD_PM_SA_ESTABLISHED only when the
> IKE negotiation failed with error is
> detected beforehand

KMD_PM_SA_ESTABLISHED
and
"IKE negotiation failed with error" ---- these two are appearing on a single event or different events?
as you say "only when the IKE negotiation failed with error is detected beforehand", mostly they would be appearing on the same event. so, simply you can use "AND" instead of the the "OR"

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="karachi" KMD_PM_SA_ESTABLISHED AND "IKE negotiation failed with error"

AND is always implied on the search by default (for example - search for "one two" means, its actually searching for "one AND two")

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="karachi" KMD_PM_SA_ESTABLISHED "IKE negotiation failed with error"

Re: search query filter

woodcock — Wed, 02 Aug 2017 14:48:37 GMT

Are these 2 conditions contained in the same event or 2 different events?