https://community.splunk.com/t5/Splunk-Search/searching-on-multiple-items/m-p/74071#M18611 <P>try uppercase OR <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 25 Jun 2013 00:28:00 GMT asimagu 2013-06-25T00:28:00Z https://community.splunk.com/t5/Splunk-Search/searching-on-multiple-items/m-p/74070#M18610 <P>I have two searches that are very similar and I want to combine the results. </P> <P>index=sonicwall new_category="Security Services" | stats count(host) by msg host | rename msg as "Warning Message" | rename count(host) as "Total Warnings"</P> <P>index=sonicwall new_category="Firewall Hardware" | stats count(host) by msg host | rename msg as "Warning Message" | rename count(host) as "Total Warnings"</P> <P>Seems like I should be able to do something like<BR /> index=sonicwall new_category="Firewall Hardware" or new_category="Security Services" but that returns nothing. </P> Mon, 28 Sep 2020 14:09:55 GMT https://community.splunk.com/t5/Splunk-Search/searching-on-multiple-items/m-p/74070#M18610 jalfrey 2020-09-28T14:09:55Z https://community.splunk.com/t5/Splunk-Search/searching-on-multiple-items/m-p/74071#M18611 <P>try uppercase OR <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 25 Jun 2013 00:28:00 GMT https://community.splunk.com/t5/Splunk-Search/searching-on-multiple-items/m-p/74071#M18611 asimagu 2013-06-25T00:28:00Z https://community.splunk.com/t5/Splunk-Search/searching-on-multiple-items/m-p/74072#M18612 <P>well that was simple. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 25 Jun 2013 00:32:32 GMT https://community.splunk.com/t5/Splunk-Search/searching-on-multiple-items/m-p/74072#M18612 jalfrey 2013-06-25T00:32:32Z