topic OR connection with missing fileds in Splunk Search

OR connection with missing fileds

alex_kh — Thu, 04 Oct 2018 11:14:55 GMT

Hello Folks, i have folowing question
I have folowing search

index=indexA OR index=indexB OR indexC user=alex OR ip=255.255.255.255 OR os= win95|table user ip os index

i expect (and i need) folowing result

alex null win95 indexA
alex 255.255.255.255 win95 indexB
null null win95 index C

curently i have
alex 255.255.255.255 win95 indexB
simon 0.0.0.0 linux indexB
betty 0.0.0.1 mac indexB

what am i doing wrong?

Re: OR connection with missing fileds

harishalipaka — Thu, 04 Oct 2018 13:29:11 GMT

@alex_kh

strings are encoded with "index1" or 'mac'

Re: OR connection with missing fileds

richgalloway — Thu, 04 Oct 2018 13:33:10 GMT

It would help to see sample events.
Adding parentheses to your query will help tell Splunk how to interpret your desires. For exanple, (index=indexA OR index=indexB OR indexC) (user=alex OR ip=255.255.255.255 OR os= win95)|....