topic regex multiple phrases in Splunk Search

regex multiple phrases

lucychang2015 — Fri, 20 Jun 2014 21:28:23 GMT

I want to see if string a and string b are in the logs, but they might not be in the same event.
And I don't want to create seperate query for each string.
How do I do that?

Re: regex multiple phrases

martin_mueller — Fri, 20 Jun 2014 21:40:00 GMT

I'm sure that's possible, got some sample data and desired results?

Re: regex multiple phrases

lguinn2 — Sat, 21 Jun 2014 18:30:16 GMT

Well, if string a and string b are actual strings (not regular expressions), then this will work

"a" OR "b"

It would be nice to include a sourcetype, source, etc. in the above search, to make it more targeted and efficient. If the strings are regular expresssions, then use this:

yoursearchhere
| where match(_raw,"a") OR match(_raw,"b")

In this case, you will have to write some search that retrieves a set of data before applying the regular expression filter. While you could use the regex command instead of the where command, I often find this way easier. With regex, you need to write a single regular expression. Combining "a" and "b" might be difficult or hard to understand.