Getting Data In

How to search for multiple fields in a source files?

New Member

So I have a set of source files that list different fields as separate events and I would like to search for source files that have the specified field values. However when I search for multiple fields (eg. diameter=30 AND temp=77) it doesn't return any results since the fields are contained in different events. Is there a way around it? All I need are the names of the source files.
Sorry if this is an obvious question, I'm still new at this

0 Karma

Path Finder

To paraphrase, it sounds like you're trying to search for particular events to generate a list of sources. From this curated list, search for a different type of events, right?

If so, make yourself familiar with sub-searches:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

Also, what precisely are you trying to look for that should belong to the first group of sources vs. what should be found from the other?

Your structure would basically look like this:

Subsearch query for the events:

source= diameter=X

Filter this to specifically the sources:

source= diameter=X | fields
source

Insert into a different search, which includes the other field:

( [search source= diameter=X
| fields source ]) temp=Y

Now you have all events that fit temp=Y but only if that source has events that match diameter=X. Let me know if that works!

0 Karma

Motivator

Hello! Try.

.....source=firstsourcefile OR source=secondsourcefile (diameter=30 AND temp=77)|......
0 Karma

New Member

Hi thanks for the response, what I'm trying to do is look through a lot of source files so I can't exactly type in all of the names of the file, it there a way to scan all source files in the index?

0 Karma

Motivator

ok let suppose that your souce name is mysource/poooo/jjjjjjj/yyyyyyy/............./ or yyyyyyyyyy/second/........

you can use the star(*) symbol to match any caracter in your source field. Something like this

source=mysource* OR source=*second* (diameter=30 AND temp=77)|...
0 Karma