topic Re: Is there a better way to write my search currently using boolean OR operators to make it shorter or more efficient? in Splunk Search

Is there a better way to write my search currently using boolean OR operators to make it shorter or more efficient?

HattrickNZ — Thu, 19 Mar 2015 02:02:17 GMT

I have the following search with OR operators

index=index1 host=host1 elementType=ET  measInfoId=117440551 OR measInfoId=117440572 OR measInfoId=117490518 |

Is there a better way of writing the OR part of this search, be it shorter or more efficient?

measInfoId=117440551 OR measInfoId=117440572 OR measInfoId=117490518

Re: Is there a better way to write my search currently using boolean OR operators to make it shorter or more efficient?

fdi01 — Thu, 19 Mar 2015 12:07:50 GMT

try like this:

 measInfoId=1174(40551 OR 40572 OR 90518 )

ex:
 index=index1 host=host1 elementType=ET  measInfoId=1174(40551 OR 40572 OR 90518 )

Re: Is there a better way to write my search currently using boolean OR operators to make it shorter or more efficient?

HattrickNZ — Thu, 19 Mar 2015 20:11:18 GMT

Tried both these and they did not work

... measInfoId=1174(40551)

... measInfoId=1174(40551 OR 40572 OR 90518)

Re: Is there a better way to write my search currently using boolean OR operators to make it shorter or more efficient?

dwaddle — Thu, 19 Mar 2015 20:31:02 GMT

There isn't a quick and easy way to make this perform better / be more efficient. Splunk's use of boolean AND/OR/NOT is generally very efficient up until you have several thousand terms in your search.

Syntactically, though, you may want something to sweeten it. Folks have brought up before the concept of field IN (aaa,bbb,ccc) as syntactic sugar around OR. This doesn't exist though.

If your list of items is LONG (tens / hundreds) you can make a CSV file and use a lookup, say called measInfoId.csv like so:

measInfoId
117440551
117440572 
117490518

And then use the inputlookup command to drag it in. It produces the same long list of OR statements just without putting your "O" and "R" keys through such a workout.

 index=index1 host=host1 elementType=ET [ | inputlookup measInfoId.csv ]