Why does the AND operator does not return results?

[bugnet]

Hi,

for some reason AND operator does not return the results, while OR operator does.
What is the way to get only the first result in the following table?

search:

(index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") | transaction source|table source,tag_name

Table:

[DavidHourani · Accepted solution]

Hi @bugnet,

The AND does not work because the tag for the same source are not for the same event, they are for multiple events with the same source field. When using AND a single event MUST match all the conditions.

In your case you have to use the OR and the most efficient way to keep the one that matches all three conditions is as follows :

 (index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") |stats dc(tag_name) as n_of_tags, values(tag_name) as tag_name by source |where n_of_tags >2

Cheers,
David