Splunk Search

How to Search for the Rows If at Least One Row in the Whole source Meets a Criteria

hpaknia
Explorer

I want to search like:

index=whatever "term_1" AND (at least one event in the source of the found record contains term_2)

Suppose source1 is:
/var/log/source1.log
event 1
event 2 term_2
event 3
event 4 term_1

source2 is:
/var/log/source2.log
event 1
event 2
event 3 term_1

When searching for term_1, I want to see the results only from source1. Because source1 also has an event having term_2 in it.

Labels (1)

muebel
SplunkTrust
SplunkTrust

I'm having difficulty understanding this 😅. Could you explain what you mean by source?

Perhaps you could drop in literal event samples? I'm not following the example presented.

0 Karma

hpaknia
Explorer

Suppose source1 is:
/var/log/source1.log
event 1
event 2 term_2
event 3
event 4 term_1

source2 is:
/var/log/source2.log
event 1
event 2
event 3 term_1

When searching for term_1, I want to see the results only from source1. Because source1 also has an event having term_2 in it.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Suppose source1 is:
/var/log/source1.log
event 1
event 2 term_2
event 3
event 4 term_1

source2 is:
/var/log/source2.log
event 1
event 2
event 3 term_1

When searching for term_1, I want to see the results only from source1. Because source1 also has an event having term_2 in it.

 

Simply, 

Index=test host=testhost term_1 term_2 (source=source1 OR source=source2)

This will search for term1 AND term2, with source1 OR source2 

I hope that's what u r looking for.

 

 

 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

hpaknia
Explorer

Not exactly. I close this question. I agree that the question is kind of ambiguous. I have to deeply learn how Splunk querying works to find my way around this.

 

Thanks

Update: Not sure how I can close the question without deleting it. 

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...