Splunk Search

Basic OR statement question

echojacques
Builder

So I have this search and it works just fine:

dest="10.*" OR dest="172.16.*" OR dest="192.168.*" AND action=failure `authentication` | table time,user,src,dest,app,action

My question is, is there a better/cleaner way to write this kind of OR statement? For example, I tried the search below and it didn't work using the pipe/OR character:

dest="10.*"|"172.16.*"|"192.168.*" AND action=failure `authentication` | table time,user,src,dest,app,action

I also tried this and it didn't work:

dest=(10.*|172.16.*|192.168.*) AND action=failure `authentication` | table time,user,src,dest,app,action

Like I said, my search at the very top works but just wondering if it's the best way to do it. Thanks!

Tags (1)
1 Solution

Ayn
Legend

Nope, that's how you would do it. If you have a long static list of destinations you could consider putting it into a lookup and then just do

[|inputlookup destinations | fields dest] AND action=failure `authentication` | table time,user,src,dest,app,action

But if this is just small lists for unique searches I'm guessing that's probably more hassle than it's worth.

View solution in original post

lukejadamec
Super Champion

Yup, your search that works is pretty much the only way to list a string of ORs.

0 Karma

Ayn
Legend

Nope, that's how you would do it. If you have a long static list of destinations you could consider putting it into a lookup and then just do

[|inputlookup destinations | fields dest] AND action=failure `authentication` | table time,user,src,dest,app,action

But if this is just small lists for unique searches I'm guessing that's probably more hassle than it's worth.

echojacques
Builder

Ok thanks for confirming my search! I have it in a dashboard panel so you're right, I'll just stick with the original version using the individual OR statements. Thanks again!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...