topic Re: Search is returning unwanted data. in Splunk Search

Search is returning unwanted data.

jsven7 — Thu, 15 Jun 2017 13:43:20 GMT

index=myindex server="server1234" OR "server1235" OR "server1236" OR "server1237" OR "server1238" | stats count(_raw) by server

results:
server1234
server123456 <----- why am I getting this?
server1235
server1236
server1237
server1238
server12347 <----- why am I getting this?
server12348 <----- why am I getting this?
server123890 <----- why am I getting this?

How do I only get in return what I asked for? Thanks in advanced.

Re: Search is returning unwanted data.

cmerriman — Thu, 15 Jun 2017 13:55:15 GMT

those are open strings. try this:

index=myindex server="server1234" OR server="server1235" OR server="server1236" OR server="server1237" OR server="server1238" | stats count(_raw) by server

or if you have splunk 6.6:

index=myindex server IN ("server1234" ,"server1235","server1236", "server1237", "server1238") | stats count(_raw) by server

Re: Search is returning unwanted data.

jsven7 — Thu, 15 Jun 2017 14:15:26 GMT

I see. thank you sir.

Re: Search is returning unwanted data.

DalJeanis — Thu, 15 Jun 2017 14:27:33 GMT

@cmerriman - I believe you are missing a close paren in the splunk 6.6 example.

Re: Search is returning unwanted data.

cmerriman — Thu, 15 Jun 2017 14:37:44 GMT

thanks @DalJeanis . i was missing a quote too...just have really hit backspace on accident a few times.

Re: Search is returning unwanted data.

jsven7 — Thu, 15 Jun 2017 14:38:54 GMT

i don't see that.

Re: Search is returning unwanted data.

jsven7 — Thu, 15 Jun 2017 14:41:38 GMT

oh you must've edited it before I saw.