topic Re: How to pull events with multiple sourcetype in Splunk Search

How to pull events with multiple sourcetype

rakesh44 — Wed, 30 Sep 2020 00:15:15 GMT

I am searching events with specific multiple sourcetype, but getting extra sourcetype.Kindly refer attached file.

Am searching sourcetype=splunkd OR sourcetype=splunkd_access

index="_internal" sourcetype=splunkd OR sourcetype=splunkd_access OR component=root OR component=Metrics | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count by sourcetype

Re: How to pull events with multiple sourcetype

whrg — Fri, 26 Apr 2019 07:42:48 GMT

I believe you have too many "OR"s.

Try this:

index="_internal" sourcetype=splunkd OR sourcetype=splunkd_access component=root OR component=Metrics | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count by sourcetype

Written differently:

index="_internal" (sourcetype=splunkd OR sourcetype=splunkd_access) AND (component=root OR component=Metrics) | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count by sourcetype

Re: How to pull events with multiple sourcetype

splunk_sv — Wed, 30 Sep 2020 00:15:18 GMT

It is due to the OR condition you have in your search query.

index="_internal" sourcetype="splunkd" OR sourcetype="splunkd_access" OR component=root OR component=Metrics | rest  of the search

It will bring all records which satisfies anyone of the condition, and when a record is found with "component=root" it is of sourcetype splunk_web_service.
So, if you don't want records from a particular sourcetype you can either filter that out using where clause or you can update your search to have AND condition as shown in the below command,

index="_internal" sourcetype="splunkd" OR sourcetype="splunkd_access" AND (component=root OR component=Metrics) |rest of the search

Re: How to pull events with multiple sourcetype

aojie654 — Fri, 26 Apr 2019 08:08:22 GMT

I'm agree with @whrg.

In my opinion, I think the boolean operators ( AND, OR, NOT) command should be included in "( )" such as index="_internal" (sourcetype=splunkd OR sourcetype=splunkd_access) (component=root OR component=Metric)
When you are using command "search" without any boolean operators, splunk will fill an AND between the search conditions. For example, index=_internal sourcetype=splunkd is equals that index=_internal AND sourcetype=splunkd.
In your case, sourcetype=* and component=* are not conflicting conditions so maybe you should better to use AND or nothing between them.