Getting Data In

How to search for multiple fields in a source files?

npestana88
New Member

So I have a set of source files that list different fields as separate events and I would like to search for source files that have the specified field values. However when I search for multiple fields (eg. diameter=30 AND temp=77) it doesn't return any results since the fields are contained in different events. Is there a way around it? All I need are the names of the source files.
Sorry if this is an obvious question, I'm still new at this

0 Karma

hcbomb
Path Finder

To paraphrase, it sounds like you're trying to search for particular events to generate a list of sources. From this curated list, search for a different type of events, right?

If so, make yourself familiar with sub-searches:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

Also, what precisely are you trying to look for that should belong to the first group of sources vs. what should be found from the other?

Your structure would basically look like this:

Subsearch query for the events:

source= diameter=X

Filter this to specifically the sources:

source= diameter=X | fields
source

Insert into a different search, which includes the other field:

( [search source= diameter=X
| fields source ]) temp=Y

Now you have all events that fit temp=Y but only if that source has events that match diameter=X. Let me know if that works!

0 Karma

stephanefotso
Motivator

Hello! Try.

.....source=firstsourcefile OR source=secondsourcefile (diameter=30 AND temp=77)|......
SGF
0 Karma

npestana88
New Member

Hi thanks for the response, what I'm trying to do is look through a lot of source files so I can't exactly type in all of the names of the file, it there a way to scan all source files in the index?

0 Karma

stephanefotso
Motivator

ok let suppose that your souce name is mysource/poooo/jjjjjjj/yyyyyyy/............./ or yyyyyyyyyy/second/........

you can use the star(*) symbol to match any caracter in your source field. Something like this

source=mysource* OR source=*second* (diameter=30 AND temp=77)|...
SGF
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...