topic Re: Basic OR statement question in Splunk Search

Basic OR statement question

echojacques — Tue, 05 Nov 2013 22:12:54 GMT

So I have this search and it works just fine:

dest="10.*" OR dest="172.16.*" OR dest="192.168.*" AND action=failure `authentication` | table time,user,src,dest,app,action

My question is, is there a better/cleaner way to write this kind of OR statement? For example, I tried the search below and it didn't work using the pipe/OR character:

dest="10.*"|"172.16.*"|"192.168.*" AND action=failure `authentication` | table time,user,src,dest,app,action

I also tried this and it didn't work:

dest=(10.*|172.16.*|192.168.*) AND action=failure `authentication` | table time,user,src,dest,app,action

Like I said, my search at the very top works but just wondering if it's the best way to do it. Thanks!

Re: Basic OR statement question

Ayn — Tue, 05 Nov 2013 22:15:45 GMT

Nope, that's how you would do it. If you have a long static list of destinations you could consider putting it into a lookup and then just do

[|inputlookup destinations | fields dest] AND action=failure `authentication` | table time,user,src,dest,app,action

But if this is just small lists for unique searches I'm guessing that's probably more hassle than it's worth.

Re: Basic OR statement question

echojacques — Tue, 05 Nov 2013 22:17:25 GMT

Ok thanks for confirming my search! I have it in a dashboard panel so you're right, I'll just stick with the original version using the individual OR statements. Thanks again!

Re: Basic OR statement question

lukejadamec — Tue, 05 Nov 2013 22:23:32 GMT

Yup, your search that works is pretty much the only way to list a string of ORs.