Splunk Search

How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1?

Motivator

I have events in which Field1 contains multiple values, but I only need to look for two values (foo AND bar) and tie them to Field2. What's the most efficient way to craft this search?

I'm basically looking for events to be returned in which Field2 has both 'foo' AND 'bar' in Field1.

Thx

0 Karma

Influencer

I'm guessing that field1 in its original context is not a multivalue field. So what you need is an additional search command after your stats command.

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) by Field2 | search (Field1=foo AND Field1=bar)
0 Karma

Motivator

I've been running the following query below and I believe I'm getting the results I need. Would be interested to see if someone could runt he same query and check if they're getting the results they'd expect as well.

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) as Total by Field2 | where Total >=2

Thx

0 Karma

Motivator

And i just realized one flaw in my logic in that Field1 will always be an 'OR' as the even though Field2 can have one of the two Field1 values, it will be one value per event. Field2 will never have 'foo' and 'bar' in the same event.

0 Karma

Motivator

Thx for the reply - actually Field1 is the multivalue field (it has seven total values, but I'm only looking to pull two)

0 Karma

Motivator

I do have the following query:

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) by Field2

But if I change the 'OR' to 'AND' it kills the query

Thx

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!