So I have this search and it works just fine:
dest="10.*" OR dest="172.16.*" OR dest="192.168.*" AND action=failure `authentication` | table time,user,src,dest,app,action
My question is, is there a better/cleaner way to write this kind of OR statement? For example, I tried the search below and it didn't work using the pipe/OR character:
dest="10.*"|"172.16.*"|"192.168.*" AND action=failure `authentication` | table time,user,src,dest,app,action
I also tried this and it didn't work:
dest=(10.*|172.16.*|192.168.*) AND action=failure `authentication` | table time,user,src,dest,app,action
Like I said, my search at the very top works but just wondering if it's the best way to do it. Thanks!
Nope, that's how you would do it. If you have a long static list of destinations you could consider putting it into a lookup and then just do
[|inputlookup destinations | fields dest] AND action=failure `authentication` | table time,user,src,dest,app,action
But if this is just small lists for unique searches I'm guessing that's probably more hassle than it's worth.
Yup, your search that works is pretty much the only way to list a string of ORs.
Nope, that's how you would do it. If you have a long static list of destinations you could consider putting it into a lookup and then just do
[|inputlookup destinations | fields dest] AND action=failure `authentication` | table time,user,src,dest,app,action
But if this is just small lists for unique searches I'm guessing that's probably more hassle than it's worth.
Ok thanks for confirming my search! I have it in a dashboard panel so you're right, I'll just stick with the original version using the individual OR statements. Thanks again!