topic Re: where field 1 or field 2 equals False in Splunk Search

where field 1 or field 2 equals False

hastrike — Mon, 15 Feb 2016 15:48:32 GMT

I have two fields in a query where they either equal True or False and I want to find all the results where these two fields equal False. I have tried | where field1 ="False" OR field2 ="False"

However, when I run this it only picks up the first field it doesn't pick up the 2nd Field? Both fields should not be false at the same time. I have also tried the search command as well instead of where.

Re: where field 1 or field 2 equals False

javiergn — Mon, 15 Feb 2016 16:08:05 GMT

You need a logical AND in this case:

| where field1 ="False" AND field2 ="False"

The OR you are using will return any event where either field1 is False or field2 is false, or both, or one of them is true and the other false.

Note you can use search too:

| search field1 ="False" AND field2 ="False"

Re: where field 1 or field 2 equals False

hastrike — Mon, 15 Feb 2016 16:23:25 GMT

I tried this and I keep getting no results found. However, it works if I use a single field or use OR instead of AND. Just need results when either are False.

Re: where field 1 or field 2 equals False

somesoni2 — Mon, 15 Feb 2016 16:53:36 GMT

From your 2nd para, it looks like you need this. This will ensure at least one of them is false and both are NOT true and both are not false.

| where field1!=field2

Re: where field 1 or field 2 equals False

hastrike — Mon, 15 Feb 2016 16:57:00 GMT

Sorry that must have been confusing. I want the results where both answers are false.

Re: where field 1 or field 2 equals False

javiergn — Mon, 15 Feb 2016 17:03:10 GMT

Hi, I'm reading your question again and your 1st paragraph contradicts your second one.

In summary:

Both fields are false at the same time:

| where field1 ="False" AND field2 ="False"

One of them is false and the other true:

| where field1 != field2

One of them is false and the other don't care:

| where field1 ="False"

| where field2 ="False"

Re: where field 1 or field 2 equals False

somesoni2 — Mon, 15 Feb 2016 17:19:52 GMT

In that case @javiergn's answer is what you're looking for. No result doesn't necessarily mean it didn't work, your data could be like that. Can you check manually to see if there really is a data satisfying your condition?