Splunk Search

Add multiple device types to search string

fschiavo
New Member

I want to add cer device type to the following string to search for both. Boolean expression?

index=cisco cdnt* partial service

Tags (1)
0 Karma

somesoni2
Revered Legend

By default all filters (separated by space here) are using AND boolean expression. you can just add your devicetype string (if its not an extracted field) OR devicetype="valuehere" (if its an extracted field).

0 Karma

kristian_kolb
Ultra Champion

Yes, with implicit AND between all search terms. Examples;

host=alice host=bob

will return no events. host cannot be both 'alice' and 'bob' at the same time.

(host=alice user=david) OR user=cecilia

will return all events from host 'alice' where user=david, and all events where user=cecilia, regardless of originiating host.

host=sales price!=55

will return all events from the host 'sales', if the events contain the field 'price' and the value is not '55'.

host=sales NOT price=55

will return all events from the host 'sales', that don't contain price=55, even events that do not have 'price' in them at all.

and so on. See more in the docs.

http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchTutorial/Aboutthesearchapp

/K

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...