How can I "or" with a Pivot?

[daniel333]

All,

I'd like to alert on process which have Netcat or nmap running for quick notable event. I can get one or the other. But not really both in the single query. I can't seem to find any sort of "OR" for the pivot language.

| pivot Application_State Processes values(process) AS "process" SPLITROW dest AS dest FILTER process startsWith nc*

Any ideas?

[dkeck]

Hi,

maybe a look at this could help you 🙂

https://answers.splunk.com/answers/547909/how-to-filter-multiple-values-with-pivot-command-i.html

[dkeck]

if it helped please accept the question 🙂