Splunk Search

Basic OR statement question

echojacques
Builder

So I have this search and it works just fine:

dest="10.*" OR dest="172.16.*" OR dest="192.168.*" AND action=failure `authentication` | table time,user,src,dest,app,action

My question is, is there a better/cleaner way to write this kind of OR statement? For example, I tried the search below and it didn't work using the pipe/OR character:

dest="10.*"|"172.16.*"|"192.168.*" AND action=failure `authentication` | table time,user,src,dest,app,action

I also tried this and it didn't work:

dest=(10.*|172.16.*|192.168.*) AND action=failure `authentication` | table time,user,src,dest,app,action

Like I said, my search at the very top works but just wondering if it's the best way to do it. Thanks!

Tags (1)
1 Solution

Ayn
Legend

Nope, that's how you would do it. If you have a long static list of destinations you could consider putting it into a lookup and then just do

[|inputlookup destinations | fields dest] AND action=failure `authentication` | table time,user,src,dest,app,action

But if this is just small lists for unique searches I'm guessing that's probably more hassle than it's worth.

View solution in original post

lukejadamec
Super Champion

Yup, your search that works is pretty much the only way to list a string of ORs.

0 Karma

Ayn
Legend

Nope, that's how you would do it. If you have a long static list of destinations you could consider putting it into a lookup and then just do

[|inputlookup destinations | fields dest] AND action=failure `authentication` | table time,user,src,dest,app,action

But if this is just small lists for unique searches I'm guessing that's probably more hassle than it's worth.

echojacques
Builder

Ok thanks for confirming my search! I have it in a dashboard panel so you're right, I'll just stick with the original version using the individual OR statements. Thanks again!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...