topic Re: Basic search cleanup - Need a list instead of many "OR" operators in Splunk Search

Basic search cleanup - Need a list instead of many "OR" operators

agoktas — Thu, 12 Feb 2015 22:40:16 GMT

Hello you syntax gurus!

This should be simple, but haven't done this yet. 😉

I just want to cleanup some of the 'OR' and provide a list instead within parenthesis (I think it's the way it works). Can you provide a cleaned up example that will search the exactly the same?

index=app_win source=service State=Stopped StartMode=Manual OR StartMode=Auto Name=IBM OR Name=CollabNet OR Name=SVN OR Name=Kofax OR Name=QAS OR Name=FLEXLm Description=IBM OR Description=CollabNet OR Description=SVN OR Description=Kofax OR Description=QAS OR Description=FLEXLm | stats count by Name StartMode host Description | rename Name as "Service Name"

Thanks!

Re: Basic search cleanup - Need a list instead of many "OR" operators

dart — Fri, 13 Feb 2015 09:03:43 GMT

A simple way of doing this would be to add tags or a lookup to the Name and/or Description fields. If you need matching other than exact match, you could use eventtypes to describe them, and then optionally tag the eventtypes too.

Re: Basic search cleanup - Need a list instead of many "OR" operators

tom_frotscher — Fri, 13 Feb 2015 09:06:52 GMT

Hi,

if you want to clean this up, i would move the filter part to a search macro. Lets say we call your macro "my_macro".
Then your search would look like this:

index=app_win source=service `my_macro` | stats count by Name StartMode host Description | rename Name as "Service Name"

Re: Basic search cleanup - Need a list instead of many "OR" operators

agoktas — Fri, 13 Feb 2015 17:38:50 GMT

Macros are definitely an option.

But I thought there was a comma delimited list you can specify to clean up just a little bit. Just to clean up some of the "OR" operators and "field=".

Just a guess (I thought it was something like this)...
Name=(IBM,CollabNet,SVN,Kofax,QAS,FLEXLm)
Description=(IBM,CollabNet,SVN,Kofax,QAS,FLEXLm)

But I tried these and they don't work.

Thanks.

Re: Basic search cleanup - Need a list instead of many "OR" operators

agoktas — Fri, 13 Feb 2015 22:30:16 GMT

Aha! I've taken 1 step forward:

index=app_win source=service State=Stopped StartMode (Auto OR Manual)
Name (IBM OR CollabNet OR SVN OR Kofax OR QAS OR FLEXLm) OR
Description (IBM OR CollabNet OR SVN OR Kofax OR QAS OR FLEXLm) OR
DisplayName (IBM OR CollabNet OR SVN OR Kofax OR QAS OR FLEXLm)
NOT (Description=Blah1 OR Blah2) | stats count by DisplayName StartMode host Description | rename DisplayName as "Service Name"

This brings up the exact same results, but is a bit cleaner. Now I just need to know how to clean up some of the redundant "OR" operators.

Any thoughts?

Or is this the best (besides creating a macro) we can do with cleanup?

Re: Basic search cleanup - Need a list instead of many "OR" operators

dwaddle — Mon, 28 Sep 2020 18:57:42 GMT

Really, "OR" is your only vehicle here. Splunk breaks searches down into basic AND / OR / NOT boolean logic operators. The SPL has no concept of an "IN" operator (even if it would be nice just from a syntactic sugar point of view). There are ways of getting around this though.

Lookups. You can make a lookup and use inputlookup and a subsearch to drag in the values from the lookup. Perhaps not appropriate here, but useful elsewhere.
Macros. Already discussed - hide the complexity for you, but doesn't really simplify it a lot
Tags and eventtypes. You could use a tag like "interesting_service_name" and tag Name=IBM Name=CollabNet and so on with that tag and then search for tag=interesting_service_name. Tags and eventtypes are interesting because they let you encapsulate this type of knowledge in a way that makes dashboards and alert searches much more generic. I have previously done something where I would make an eventtype highlighting a particular error condition, and then tag that eventtype as "alertable". Then, I would schedule a search that simply searched for "tag=alertable", and let Splunk figure out what all eventtypes I had tagged that way and what raw events matched that eventtype. From there, anyone who wanted to add an event to an existing alert trigger would only need to tag it appropriately and things just worked...

TL;DR - tags are cool.