Splunk Search

Boolean operators, searches, and simplification?

Explorer

Hi, all.

I'd like to know if I've been wasting time over the last few years by using an overly formal grammar for performing Splunk searches.

Let's say I have an extracted field called "color" and I want to search for several colors in my data...red, blue, and black. Here's what my searches look like right now:

color="red" OR color="blue" OR color="black"

Assume that this search works correctly and Splunk returns the data I expect. Even though the search works, I'd like to be able to search using a more compressed query string, something like one of the three examples below:

color=(red,blue,black)

or

color=("red","blue","black")

or even

color=("red" OR "blue" OR "black")

I could really save a lot of typing on those queries when I'm looking for 20 or more colors at a time. Did I overlook a page in the Splunk documentation? If it cannot be done, that's fine too. 🙂

Thanks!

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

I don't think there's anything in the splunk search language that performs exactly this way.

Some possible approaches:

  1. You could tag your desired values to create an effecive category.

tag::cool_colors

where color=red colore=blue and color=black had been tagged cool_colors.

  1. macros. You can create a macro that expands to a fixed string, or takes a fixed number of arguments and inserts them into a fixed string. This is simple string replacement.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

I don't think there's anything in the splunk search language that performs exactly this way.

Some possible approaches:

  1. You could tag your desired values to create an effecive category.

tag::cool_colors

where color=red colore=blue and color=black had been tagged cool_colors.

  1. macros. You can create a macro that expands to a fixed string, or takes a fixed number of arguments and inserts them into a fixed string. This is simple string replacement.

View solution in original post

0 Karma

Explorer

Thanks, jrodman.

I agree that I'm pretty much asking for something that's just not possible right now. think I'll submit a feature request and see what the Splunk devs say.

0 Karma