Getting Data In

Why does the AND operator does not return results?

bugnet
Path Finder

Hi,

for some reason AND operator does not return the results, while OR operator does.
What is the way to get only the first result in the following table?

search:

(index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") | transaction source|table source,tag_name

Table:

alt text

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @bugnet,

The AND does not work because the tag for the same source are not for the same event, they are for multiple events with the same source field. When using AND a single event MUST match all the conditions.

In your case you have to use the OR and the most efficient way to keep the one that matches all three conditions is as follows :

 (index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") |stats dc(tag_name) as n_of_tags, values(tag_name) as tag_name by source |where n_of_tags >2

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @bugnet,

The AND does not work because the tag for the same source are not for the same event, they are for multiple events with the same source field. When using AND a single event MUST match all the conditions.

In your case you have to use the OR and the most efficient way to keep the one that matches all three conditions is as follows :

 (index=misp-events source="/var/scripts/events/*.json") (tag_name="misp-galaxy:continents=\"Asia\"" OR tag_name="misp-galaxy:targeted-region=\"Ukraine\"" OR tag_name="misp-galaxy:ransomware=\"*") |stats dc(tag_name) as n_of_tags, values(tag_name) as tag_name by source |where n_of_tags >2

Cheers,
David

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...