Splunk Search

AND Condition to find the keywords in logs

abhishekgandhe
Explorer

I have log. I want to find all 4 keywords. It should be AND condition and not OR.
Critical Lab
Lab
Critical Process
Process
If any one of them is not present then fail. If all 4 present then pass.
How to do it in Regex.

Tags (1)

ddrillic
Ultra Champion

"Critical Lab" AND "Critical Process" AND Process should do it...

0 Karma

abhishekgandhe
Explorer

I have written REGEX for this. Is this the correct one.

index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" (Critical-Lab AND \"LAB AND Critical-Process AND \"Process)

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

If you find "Critical Lab" in an event does that also mean "Lab" has also been found?

0 Karma

493669
Super Champion

Can you please share some sample logs(with masking sensitive data) to create regex expression

0 Karma

abhishekgandhe
Explorer

"Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"

0 Karma

pramit46
Contributor

First of all, you don't need to check all four, since 1st and 3rd also cover for 2nd and 4th.

Secondly, your sample does not tell us where the word(s) 'Critical Process' will occur. I doubt if people will be able to help you without a proper sample.

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...