Splunk Search

Add multiple device types to search string

fschiavo
New Member

I want to add cer device type to the following string to search for both. Boolean expression?

index=cisco cdnt* partial service

Tags (1)
0 Karma

somesoni2
Revered Legend

By default all filters (separated by space here) are using AND boolean expression. you can just add your devicetype string (if its not an extracted field) OR devicetype="valuehere" (if its an extracted field).

0 Karma

kristian_kolb
Ultra Champion

Yes, with implicit AND between all search terms. Examples;

host=alice host=bob

will return no events. host cannot be both 'alice' and 'bob' at the same time.

(host=alice user=david) OR user=cecilia

will return all events from host 'alice' where user=david, and all events where user=cecilia, regardless of originiating host.

host=sales price!=55

will return all events from the host 'sales', if the events contain the field 'price' and the value is not '55'.

host=sales NOT price=55

will return all events from the host 'sales', that don't contain price=55, even events that do not have 'price' in them at all.

and so on. See more in the docs.

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchTutorial/Aboutthesearchapp

/K

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...