- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to Search for the Rows If at Least One Row in the Whole source Meets a Criteria
I want to search like:
index=whatever "term_1" AND (at least one event in the source of the found record contains term_2)
Suppose source1 is:
/var/log/source1.log
event 1
event 2 term_2
event 3
event 4 term_1
source2 is:
/var/log/source2.log
event 1
event 2
event 3 term_1
When searching for term_1, I want to see the results only from source1. Because source1 also has an event having term_2 in it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
I'm having difficulty understanding this 😅. Could you explain what you mean by source?
Perhaps you could drop in literal event samples? I'm not following the example presented.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Suppose source1 is:
/var/log/source1.log
event 1
event 2 term_2
event 3
event 4 term_1
source2 is:
/var/log/source2.log
event 1
event 2
event 3 term_1
When searching for term_1, I want to see the results only from source1. Because source1 also has an event having term_2 in it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
Suppose source1 is:
/var/log/source1.log
event 1
event 2 term_2
event 3
event 4 term_1
source2 is:
/var/log/source2.log
event 1
event 2
event 3 term_1
When searching for term_1, I want to see the results only from source1. Because source1 also has an event having term_2 in it.
Simply,
Index=test host=testhost term_1 term_2 (source=source1 OR source=source2)
This will search for term1 AND term2, with source1 OR source2
I hope that's what u r looking for.
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not exactly. I close this question. I agree that the question is kind of ambiguous. I have to deeply learn how Splunk querying works to find my way around this.
Thanks
Update: Not sure how I can close the question without deleting it.
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)