topic Re: Boolean Query in Splunk Search

Boolean Query

aoliullah — Tue, 24 Jan 2017 14:47:43 GMT

Hi. The following query doesn't seem to work for me.

sourcetype="vendor_sales" VendorCountry=("United States" AND "Canada")

I want it to return sales events for both US and Canada.

Could you help?

Re: Boolean Query

gcusello — Tue, 24 Jan 2017 14:50:26 GMT

Hi aoliullah,
try with
sourcetype="vendor_sales" (VendorCountry="United States" OR VendorCountry="Canada")
Bye.
Giuseppe

Re: Boolean Query

woodcock — Tue, 24 Jan 2017 15:14:14 GMT

Like this:

sourcetype="vendor_sales" VendorCountry="United States" AND VendorCountry="Canada"

But this will only show those vendors who sold both in "United States" and "Canada" in a single event (where VendorCountry is a multivalued field). But this is probably not your desire. You are probably trying to do this:

sourcetype="vendor_sales" VendorCountry="United States" OR VendorCountry="Canada"