How to add 2-3 fields in single query

[aditsss]

Hi Everyone,

I have one requirement.

I have two queries like this:

index=abc  ns=sidh-datagraph3 "NullPointerException"

index=abc  ns=sidh-datagraph3 "IllegalStateException"

I want to combine it in a same query.

Can someone guide me on this.

Thanks in advance

[isoutamo · Accepted solution]

You should try

index=abc  ns=sidh-datagraph3 ("NullPointerException" OR "IllegalStateException")

(fixed)

r. Ismo 

[s2_splunk]

You probably want parenthesis in there:

index=abc  ns=sidh-datagraph3 ("NullPointerException" OR "IllegalStateException")