Boolean Query

[aoliullah]

Hi. The following query doesn't seem to work for me.

sourcetype="vendor_sales" VendorCountry=("United States" AND "Canada")

I want it to return sales events for both US and Canada.

Could you help?

[woodcock]

Like this:

sourcetype="vendor_sales" VendorCountry="United States" AND VendorCountry="Canada"

But this will only show those vendors who sold both in "United States" and "Canada" in a single event (where VendorCountry is a multivalued field). But this is probably not your desire. You are probably trying to do this:

sourcetype="vendor_sales" VendorCountry="United States" OR VendorCountry="Canada"

[gcusello · Accepted solution]

Hi aoliullah,
try with
sourcetype="vendor_sales" (VendorCountry="United States" OR VendorCountry="Canada")
Bye.
Giuseppe