Getting Data In

Why does the AND operator does not return results?

bugnet
Path Finder

Hi,

for some reason AND operator does not return the results, while OR operator does.
What is the way to get only the first result in the following table?

search:

(index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") | transaction source|table source,tag_name

Table:

alt text

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @bugnet,

The AND does not work because the tag for the same source are not for the same event, they are for multiple events with the same source field. When using AND a single event MUST match all the conditions.

In your case you have to use the OR and the most efficient way to keep the one that matches all three conditions is as follows :

 (index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") |stats dc(tag_name) as n_of_tags, values(tag_name) as tag_name by source |where n_of_tags >2

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @bugnet,

The AND does not work because the tag for the same source are not for the same event, they are for multiple events with the same source field. When using AND a single event MUST match all the conditions.

In your case you have to use the OR and the most efficient way to keep the one that matches all three conditions is as follows :

 (index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") |stats dc(tag_name) as n_of_tags, values(tag_name) as tag_name by source |where n_of_tags >2

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...