Dashboards & Visualizations

How to add two filter criteria in one search query

aditsss
Motivator

Hi Everyone,

I have two search queries with two filter criteria's 

1st query:

index=abc ns=xyz app_name=sd "ARC EVENT RECEIVED FROM SOURCE"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count, by sourceagent,RID
| rename sourceagent as "Source"|fields RID Source

2nd query

index=abc ns=xyz app_name=sd"ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count, by sourceagent,RID
| rename sourceagent as "Source"|fields RID Source

Since the search is same for both only the filter criteria is different like "ARC EVENT RECEIVED FROM SOURCE" and "ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF".

How can I make it a single query with two filter criteria.

Can someone guide me on that.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=abc ns=xyz app_name=sd "ARC EVENT RECEIVED FROM SOURCE" OR "ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count, by sourceagent,RID
| rename sourceagent as "Source"|fields RID Source

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=abc ns=xyz app_name=sd "ARC EVENT RECEIVED FROM SOURCE" OR "ARC SUCCESSFULLY UPDATED RESPONSE BACK TO SOURCE OR SF"| rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)"
| stats count, by sourceagent,RID
| rename sourceagent as "Source"|fields RID Source
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...