All Apps and Add-ons

How to search for two separate keywords

jgarman
New Member

I'm trying to figure out the Search function to be able to look for a client. It doesn't return any logs that when i put in two strings/words

My examples that don't return anything in the search function are as follows.

BigTechU and ERROR

BigTechU|ERROR

BigTechU; ERROR

also i don't know how to look for parts of dates in my query.

I'm just trying to build a POC to use SPLUNK fully for our support system but i'm new and struggling.

any help would be wonderful.

regards,

 

JG

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you searching for events which have both BigTechU and ERROR?

If so, you can just have both words without the and or have AND (in caps)

If you want events which have either BigTechU or ERROR, then you need OR (in caps) between them

0 Karma

zonistj
Path Finder

I'd like to help you. Can you post a sample of the syntax you're trying to use using? Please be mindful not to post sensitive information.

I think you just want to do ("BigTechU" OR "error") but I'm not totally clear on what you're trying to do. Do you want to look for events that contain both keywords or events that contain at least one of them?

0 Karma

jgarman
New Member

i figured it out.

BIGTECHU ERROR seemed to work unless there is a date involved and then i would use ""

thanks for the options.

regards

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>