topic Re: AND Condition to find the keywords in logs in Splunk Search

AND Condition to find the keywords in logs

abhishekgandhe — Mon, 29 Oct 2018 04:37:37 GMT

I have log. I want to find all 4 keywords. It should be AND condition and not OR.
Critical Lab
Lab
Critical Process
Process
If any one of them is not present then fail. If all 4 present then pass.
How to do it in Regex.

Re: AND Condition to find the keywords in logs

493669 — Mon, 29 Oct 2018 04:43:01 GMT

Can you please share some sample logs(with masking sensitive data) to create regex expression

Re: AND Condition to find the keywords in logs

abhishekgandhe — Mon, 29 Oct 2018 06:18:21 GMT

"Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"

Re: AND Condition to find the keywords in logs

msivill_splunk — Mon, 29 Oct 2018 12:30:10 GMT

If you find "Critical Lab" in an event does that also mean "Lab" has also been found?

Re: AND Condition to find the keywords in logs

pramit46 — Mon, 29 Oct 2018 13:29:20 GMT

First of all, you don't need to check all four, since 1st and 3rd also cover for 2nd and 4th.

Secondly, your sample does not tell us where the word(s) 'Critical Process' will occur. I doubt if people will be able to help you without a proper sample.

Re: AND Condition to find the keywords in logs

ddrillic — Mon, 29 Oct 2018 14:44:38 GMT

"Critical Lab" AND "Critical Process" AND Process should do it...

Re: AND Condition to find the keywords in logs

abhishekgandhe — Tue, 30 Oct 2018 06:44:57 GMT

I have written REGEX for this. Is this the correct one.

index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" (Critical-Lab AND \"LAB AND Critical-Process AND \"Process)