Archive

Boolean Query

Path Finder

Hi. The following query doesn't seem to work for me.

sourcetype="vendor_sales" VendorCountry=("United States" AND "Canada")

I want it to return sales events for both US and Canada.

Could you help?

0 Karma
1 Solution

Legend

Hi aoliullah,
try with
sourcetype="vendor_sales" (VendorCountry="United States" OR VendorCountry="Canada")
Bye.
Giuseppe

View solution in original post

Esteemed Legend

Like this:

sourcetype="vendor_sales" VendorCountry="United States" AND VendorCountry="Canada"

But this will only show those vendors who sold both in "United States" and "Canada" in a single event (where VendorCountry is a multivalued field). But this is probably not your desire. You are probably trying to do this:

sourcetype="vendor_sales" VendorCountry="United States" OR VendorCountry="Canada"

Legend

Hi aoliullah,
try with
sourcetype="vendor_sales" (VendorCountry="United States" OR VendorCountry="Canada")
Bye.
Giuseppe

View solution in original post