topic OR operator problem in Splunk Search

OR operator problem

bugnet — Tue, 29 Sep 2020 13:49:35 GMT

Hi all,

Hey, what's wrong with the next search structure?
I'm using OR operator because the field names are different in each index.

(index=fw product=barracuda severity>=5 geo!=Greece)
OR (index=apache msg!=error )
OR (index=nac Name!="pass" Name!="manage" Name!="error")
AND src_ip!=10.0.0.0/8 src_ip!=172.16.0.0/12 src_ip!=192.168.0.0/16

Thanks

Re: OR operator problem

richgalloway — Tue, 25 Apr 2017 13:07:25 GMT

What makes you think something is wrong?

There is a missing '=' before "manage", but I assume that's in the question and not in the query.

Re: OR operator problem

DalJeanis — Wed, 26 Apr 2017 12:53:32 GMT

Item 1 - Computer Science 101: mixing ORs and ANDs without specifying order of operation.

Assuming it's what you mean, try:

((index=fw product=barracuda severity>=5 geo!=Greece)
OR (index=apache msg!=error )
OR (index=nac Name!="pass" Name!="manage" Name!="error"))
AND ( rc_ip!=10.0.0.0/8 AND  src_ip!=172.16.0.0/12 AND src_ip!=192.168.0.0/16)

Item 2 - IP specification

For the second phrase, you probably mean...

AND NOT
((src_ip>=10.0.0.0 AND  src_ip<=10.0.0.8 ) OR 
 (src_ip>=172.16.0.0 AND  src_ip<=172.16.0.12 ) OR 
 (src_ip>=192.168.0.0 AND  src_ip<=192.168.0.16 ) )

...except that's not right either, since it's lexicographical comparison, but you get the idea.

Myself, I'd probably break that out into a separate search or regex, as the first verb after the initial search, which might look something like this...

| regex rc_ip!="^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$"

| search NOT match(rc_ip,"^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$")

| where NOT match(rc_ip,"^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$")