About the results when multiple search conditions are specified

[Msugiyama]

Is there an SPL idea that allows you to specify multiple conditions with "OR" and assign a control number to the search results for each condition?

=====SPL=====
index=xxxx sourcetype=yyyy
(ip=10.1.1.10 url=google.com earlest=1642899600 latest=1642900200 )
OR
(ip=10.1.1.20 url=facebook.com earlest=1642849200 latest=1642849800 )
OR
(ip= ・・・・

=====The expected search results=====
NO,ip,url,_time
1,10.1.1.10,google.com/xxx,2022-01-23 10:04:30
2,10.1.1.20,facecook.com/xxxxx,2022-01-22 20:01:00
2,10.1.1.20,facecook.com/xxxxx,2022-01-22 20:01:30
3,・・・・

[isoutamo]

Hi

Your example should work after you fix earlest -> earliest.

At least this works for me

index=index1 (user=user1 earliest=1637144468 latest=1637154468) OR (user=user2 earliest=1637145675 latest=1647145675) OR (user=user3 earliest=0 latest=now)
| stats count min(_time) as minTime max(_time) as maxTime values(_time) as Times by user
| streamstats count as NO
| convert ctime(Times) as _time
| table NO, user, _time

Even user1 exists outside of it's earliest - latests period and user3 has all time, it did't found user1, but user2 and user3 have found.

You 

r. Ismo

[Msugiyama]

Thank you for your reply, and I'm sorry for the typo

As for the search condition, I want to create a subsearch from the lookup file with the format command and execute it.
The lookup file is expected to be updated at the request of the user.
If the user specification is blank, multiple hits may occur, so numbers cannot be assigned for each user.
I want to assign a control number within the range specified by OR.

The idea was helpful. thank you.