topic Re: Why is my "OR" statement not working? in Splunk Search

Why is my "OR" statement not working?

icyfeverr — Wed, 24 Sep 2014 15:54:51 GMT

When running my first and second searches independently the searches run fine and return a result within seconds.

First:
(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010")

Second:
(earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")

When I try to run them together though, I start running into issues:

Combined Search:
( earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010" ) OR ( earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010" )

When reviewing the Job Inspector on the Combined Search, it shows that the earliestTime is set to "2008-12-15T23:01:04.000-06:00". Why is this occuring when using the "OR" statement?

Re: Why is my "OR" statement not working?

aweitzman — Wed, 24 Sep 2014 17:27:38 GMT

I don't think you can have two different time ranges in the same search. You should be able to run two searches and append them to get the same effect, though:

(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010") | append [search (earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")]

Re: Why is my "OR" statement not working?

MuS — Wed, 24 Sep 2014 17:38:26 GMT

Hi aweitzman,

it is possible to use two different time ranges in one search, see this http://answers.splunk.com/answers/153336/is-it-possible-to-use-earliest-twice-in-one-search.html

cheers, MuS

Re: Why is my "OR" statement not working?

aweitzman — Wed, 24 Sep 2014 18:09:17 GMT

Ha! You learn something new every day. That's what you get when you don't try things out yourself.

So I tried it out for myself, and discovered something interesting. Searching each time range separately has the earliest and latest times set correctly, but searching them with an OR in between made it so that it windowed the search by the range of the time picker in the search bar. So if that were set to, say, "All Time," it would search over the entire contents of your sourcetypes just to pull out data between those two date ranges. By the same token, if it were set to "Today", it would cut off entries outside of today and give you an incomplete answer. (And if it were set to something that didn't overlap with either of the date ranges in the search, it would give you an error.)

Hard to believe, but it looks like my "append" answer might actually be more efficient and/or correct in some cases.

Re: Why is my "OR" statement not working?

icyfeverr — Wed, 24 Sep 2014 18:53:24 GMT

Just as a note, when using append and you have more than 100,000 events returned, anything after the 100,000 will be a blank result. However, you can still pipe the search to say table and/or stats and be able to utilize the data, just can't view the events past that, I am sure there is a setting to increase that before someone replies to this 🙂 .