topic Re: Separate multiple splunk values with an OR clause? in Splunk Search

Separate multiple splunk values with an OR clause?

MM0071 — Tue, 25 Oct 2022 15:24:41 GMT

I have a text box in a splunk dashboard and I'm trying to find out how I can separate values entered into the text box that are separated by commas with a OR clause. for example:

values entered into text box: 102.99.99, 103.99.93, 203.23.21

Where this search (index=abc sourcetype=abc src_ip="$ip$") would translate to:

index=abc sourcetype=abc src_ip="102.99.99 OR 103.99.93 OR 203.23.21"

Any suggestions?

Re: Separate multiple splunk values with an OR clause?

gcusello — Tue, 25 Oct 2022 15:43:40 GMT

Hi @MM0071,

did you tried with replace command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Replace)?

| replace "," WITH " OR" IN <your_field>

Ciao.

Giuseppe

Re: Separate multiple splunk values with an OR clause?

MM0071 — Tue, 25 Oct 2022 15:45:52 GMT

I have not. I'm very green with Splunk. How would the syntax for this work?

Re: Separate multiple splunk values with an OR clause?

johnhuang — Tue, 25 Oct 2022 16:05:29 GMT

Your best bet for this scenarios is to use "IN" which allows you to search for a comma delimited list of values.

For this to work, the input needs to be comma delimited, does not support "OR".

E.g. your input: 102.99.99, 103.99.93, 203.23.21

Change this: index=abc sourcetype=abc src_ip="$ip$" To this: index=abc sourcetype=abc src_ip IN ($ip$)

Re: Separate multiple splunk values with an OR clause?

MM0071 — Tue, 25 Oct 2022 16:16:59 GMT

This was perfect. Thank you. Not sure why I didn't think about this.