topic How to search based on multiple indexes and their respective sourceTypes in Splunk Search

How to search based on multiple indexes and their respective sourceTypes

nainil0683 — Thu, 26 Sep 2024 18:36:16 GMT

Hi,

I have index called Index1 which has sourcetype called SourceType1 and another index called Index2 with sourceType called SourceType2.

Some data is in combination of Index1<-> SourceType1 and some data is in combination of Index2<->SourceType2.

How can I write a query that targets the correct index and sourceType?

sainag_splunk — Thu, 26 Sep 2024 18:48:18 GMT

Do you mean like this ?

(index=Index1 sourcetype=SourceType1) OR (index=Index2 sourcetype=SourceType2)

nainil0683 — Thu, 26 Sep 2024 18:54:17 GMT

Yes, exactly like this.

I was beating around the bushes, but this one works perfectly.

Thanks a lot @sainag_splunk 👍

sainag_splunk — Thu, 26 Sep 2024 19:03:36 GMT

Glad it was helpful.

If this reply helps you an upvote and "Accept as Solution" is appreciated.