- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
rkishoreqa
Communicator
02-05-2021
07:12 AM
Hi,
I need to do search with multiple raw strings within a single query. When I search these strings separately, I am able to get the results. But when I combine these it is not giving the results and ending with 'No results found'.
The below three queries are working fine.
- sourcetype="States*" *Karnataka*
- sourcetype="States*" *Tamil Nadu*
- sourcetype="States*" *Mumbai*
When I execute the below query I am getting 'No results found' comment.
- sourcetype="States*" *Karnataka* *Tamil Nadu* *Mumbai*
Can anyone through some light on this, thanks in advance.
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
02-05-2021
07:17 AM
SPL inserts an implicit AND between each search term. To search for optional terms, insert an explicit OR.
sourcetype="States*" ("*Karnataka*" OR "*Tamil Nadu*" OR "*Mumbai*")
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
02-05-2021
07:17 AM
SPL inserts an implicit AND between each search term. To search for optional terms, insert an explicit OR.
sourcetype="States*" ("*Karnataka*" OR "*Tamil Nadu*" OR "*Mumbai*")
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
saravanan90
Contributor
02-05-2021
07:13 AM
Please use "OR" inbetween the searches..
sourcetype="States*" (*Karnataka* OR *Tamil Nadu* OR *Mumbai*)
