topic How to add multiple field in a single search in Splunk Search

How to add multiple field in a single search

jaibalaraman — Thu, 23 May 2024 08:59:21 GMT

How to write spl search query by adding multiple field in single search

Field 1 - contain data like authorization " Write or Read "

Field 2 - contain user id details like " @abc.com , user1, user 2,

Question

How to write a spl query

Index =testing ("write" AND " @abc.com" )

spl query to add multiple filed which contain " write " AND "@abc.com" when these condition satisfied an alert has to been sent

Re: How to add multiple field in a single search

ITWhisperer — Thu, 23 May 2024 09:06:55 GMT

Try

Index=testing ("write" AND " @abc.com" )

What results do you get?

Re: How to add multiple field in a single search

jaibalaraman — Thu, 23 May 2024 11:00:43 GMT

yes i can see the output. However the search returns based on the string mentioned in the bracket and also additionally it returns most of other user id

example - @abc.com , @test.com , testing.@test.co

Re: How to add multiple field in a single search

ITWhisperer — Thu, 23 May 2024 11:12:48 GMT

Please share some of the events whish are being returned incorrectly (anonymised appropriately)

Re: How to add multiple field in a single search

jaibalaraman — Thu, 23 May 2024 11:21:48 GMT

Hi please

find the below image

Re: How to add multiple field in a single search

ITWhisperer — Thu, 23 May 2024 12:02:17 GMT

Please paste the text (not an image) of the search into code block (otherwise, it is too small to be read easily)

Re: How to add multiple field in a single search

norbertt911 — Thu, 23 May 2024 14:35:56 GMT

May I misunderstand your question, but it's simple:

index= testing field1="write" field2="*@abc.com" |table field1, field2, ....

if "@abc.com" is a user name and not a domain (as I assume) you do not need to put the wildcard (*) before. If you put it, it will result in every user with @abc.com. Like, user1@abc.com, user2@abc.com...

alternative:

index=testing | stats count by field1 field2 | search field1="write" AND field2"*@abc.com"

Regards,