topic Re: Search within 2 entries in Splunk Search

Search within 2 entries

Ikanui123 — Thu, 28 Jun 2012 01:56:14 GMT

Hello,

I want to search for an entry that contains UsersController#update and with the following entry that contain current_user='32'.

If I search it independently I got search results. But if I do both I get nothing.

Is anyone has an idea of the search that I have to do?

Thanks a lot!

Re: Search within 2 entries

bwooden — Thu, 28 Jun 2012 02:05:24 GMT

Are you wanting events that have either or that have both? If either, the query would be current_user='32' OR "UsersController#update" For both, it would be current_user='32' "UsersController#update"

Re: Search within 2 entries

Ikanui123 — Thu, 28 Jun 2012 21:54:06 GMT

thanks for replying, just as I said when searching for

current_user='32' "UsersController#update"

nothing is returned, since its not in the same entry. Thanks.

Re: Search within 2 entries

Ayn — Fri, 29 Jun 2012 05:29:16 GMT

 current_user="32" OR "UsersController#Update"