topic Re: Match using OR statement in Splunk Search

Match using OR statement

rlautman — Mon, 28 Sep 2020 14:26:07 GMT

In in my host field I have several different addresses, 4 of these addresses are from Location1 and the rest are from Location2. I have constructed the below query to look for the matching addresses within the host fields and assign Location1 to those that match. I can't seem to look for the addresses I want to find in one match statement and the results from the query below, although correct, are a bit messy. Is is possible to use an OR statement within a match or is there another way of going about this?

index=serverapps | eval Loc=if((match(host,"12.34.56.78*")),"Location1","Location2") | eval Loc1=if((match(host,"12.345.67.*")),"Location1","Location2") | stats count by host,Loc,Loc1

Re: Match using OR statement

linu1988 — Thu, 25 Jul 2013 17:40:16 GMT

why not use a lookup, that will be easy and will be reliable with more results coming in future. You can also use CASE for this as well.

Re: Match using OR statement

reed_kelly — Thu, 25 Jul 2013 18:04:21 GMT

Match uses PCRE, so you have to escape "." as 1\.2\.3\.4, and you can use the | character as an OR operation:

match(host, "1\.2\.3\.4|5\.6\.7\.8")

Re: Match using OR statement

rlautman — Fri, 26 Jul 2013 16:14:19 GMT

This has worked a treat, thanks