How to search for two separate keywords

[jgarman]

I'm trying to figure out the Search function to be able to look for a client. It doesn't return any logs that when i put in two strings/words

My examples that don't return anything in the search function are as follows.

BigTechU and ERROR

BigTechU|ERROR

BigTechU; ERROR

also i don't know how to look for parts of dates in my query.

I'm just trying to build a POC to use SPLUNK fully for our support system but i'm new and struggling.

any help would be wonderful.

regards,

JG

[ITWhisperer]

Are you searching for events which have both BigTechU and ERROR?

If so, you can just have both words without the and or have AND (in caps)

If you want events which have either BigTechU or ERROR, then you need OR (in caps) between them

[zonistj]

I'd like to help you. Can you post a sample of the syntax you're trying to use using? Please be mindful not to post sensitive information.

I think you just want to do ("BigTechU" OR "error") but I'm not totally clear on what you're trying to do. Do you want to look for events that contain both keywords or events that contain at least one of them?

[jgarman]

i figured it out.

BIGTECHU ERROR seemed to work unless there is a date involved and then i would use ""

thanks for the options.

regards