Splunk Search

AND Condition to find the keywords in logs

abhishekgandhe
Explorer

I have log. I want to find all 4 keywords. It should be AND condition and not OR.
Critical Lab
Lab
Critical Process
Process
If any one of them is not present then fail. If all 4 present then pass.
How to do it in Regex.

Tags (1)

ddrillic
Ultra Champion

"Critical Lab" AND "Critical Process" AND Process should do it...

0 Karma

abhishekgandhe
Explorer

I have written REGEX for this. Is this the correct one.

index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" (Critical-Lab AND \"LAB AND Critical-Process AND \"Process)

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

If you find "Critical Lab" in an event does that also mean "Lab" has also been found?

0 Karma

493669
Super Champion

Can you please share some sample logs(with masking sensitive data) to create regex expression

0 Karma

abhishekgandhe
Explorer

"Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"

0 Karma

pramit46
Contributor

First of all, you don't need to check all four, since 1st and 3rd also cover for 2nd and 4th.

Secondly, your sample does not tell us where the word(s) 'Critical Process' will occur. I doubt if people will be able to help you without a proper sample.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...