Splunk Search

AND Condition to find the keywords in logs

abhishekgandhe
Explorer

I have log. I want to find all 4 keywords. It should be AND condition and not OR.
Critical Lab
Lab
Critical Process
Process
If any one of them is not present then fail. If all 4 present then pass.
How to do it in Regex.

Tags (1)

ddrillic
Ultra Champion

"Critical Lab" AND "Critical Process" AND Process should do it...

0 Karma

abhishekgandhe
Explorer

I have written REGEX for this. Is this the correct one.

index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" (Critical-Lab AND \"LAB AND Critical-Process AND \"Process)

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

If you find "Critical Lab" in an event does that also mean "Lab" has also been found?

0 Karma

493669
Super Champion

Can you please share some sample logs(with masking sensitive data) to create regex expression

0 Karma

abhishekgandhe
Explorer

"Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"

0 Karma

pramit46
Contributor

First of all, you don't need to check all four, since 1st and 3rd also cover for 2nd and 4th.

Secondly, your sample does not tell us where the word(s) 'Critical Process' will occur. I doubt if people will be able to help you without a proper sample.

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...