how can I search for multiple event IDs?

[levyma2]

How would I search for multiple event IDs ?

sourcetype=wineventlog:security EventCode=631 OR Eventcode=632 OR EventCode=633 .......

Is there a way to combine the eventIDs in one EventCode statement?

thanks

Mark

[aelliott]

Or you could have a lookup table with all of your values you want included:
http://answers.splunk.com/answers/26989/does-splunk-have-an-equivalent-to-sqls-in-construct

[levyma2]

Thanks everyone for your input. Now I have a few options to choose from.

Mark

[somesoni2]

Another one (little crude, but more generic)

sourcetype=wineventlog:security [* | head 1 | eval EventCode="631,632,633..add all your want separated by comma" |table EventCode| eval EventCode=split(EventCode,",")| mvexpand EventCode]

[lukejadamec]

Yes, but only for very specific cases.
In the case of your example you could use:

sourcetype=wineventlog:security | regex "EventCode=63[1-3]" |stats count by EventCode ComputerName

[Ayn]

Oh come on don't be hurt 🙂

I'm merely stating the problem with the approach. It's still a valid approach but it's important to point out its drawbacks. Between the 3 supplied answers here I believe we've showed what various approaches the user can take. Each of them has its own advantages and disadvantages.

[lukejadamec]

Splunk Answers is free support, and a mess with half solutions. I say if you have a better anwser - then post it. If you can make an answer better then - adjust it.
It is easy to be a critic.

[lukejadamec]

sourcetype=wineventlog:security EventCode="63*" | regex "EventCode=63[1-3]" |stats count by EventCode ComputerName

[Ayn]

The problem with this is that it would lead to bad performance, because no filtering on EventCode will be done at all in the base search.

[Ayn]

No. An OR separated list like the one you've written is the way to go.