https://community.splunk.com/t5/Splunk-Search/Need-help-on-subsearch/m-p/85663#M21882 <P>Hi Alice,</P> <P>Have you tried something like this?</P> <P><CODE>* [search ipAddress=123 AND userId=123 AND productId=123 | fields + ipAddress,userId,productId | format "(" "(" "OR" ")" "OR" ")"]</CODE></P> Thu, 11 Nov 2010 12:06:19 GMT hulahoop 2010-11-11T12:06:19Z https://community.splunk.com/t5/Splunk-Search/Need-help-on-subsearch/m-p/85662#M21881 <P>I have a log statement that looks list this: ipAddress=1.2.3.4,userId=42,productId=24</P> <P>Currently I manually first search "ipAddress=" AND "userId=" AND "productId=" to pull out the 3 values. Then I search for the union of these fields: search "ipAddress=1.2.3.4" OR "userId=42" OR "productId=24".</P> <P>How can I automated this two searches? I tried following the subsearch example but it's not working.</P> Tue, 09 Nov 2010 01:03:16 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-on-subsearch/m-p/85662#M21881 wang 2010-11-09T01:03:16Z https://community.splunk.com/t5/Splunk-Search/Need-help-on-subsearch/m-p/85663#M21882 <P>Hi Alice,</P> <P>Have you tried something like this?</P> <P><CODE>* [search ipAddress=123 AND userId=123 AND productId=123 | fields + ipAddress,userId,productId | format "(" "(" "OR" ")" "OR" ")"]</CODE></P> Thu, 11 Nov 2010 12:06:19 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-on-subsearch/m-p/85663#M21882 hulahoop 2010-11-11T12:06:19Z