Splunk Search

How to get two different field values In a query

aaa2324
Explorer

Hi Team

I am looking to get two different field values in a single query in Splunk, example, I have two different country codes and would like to get both their values 

Request.countrycode=EU

Request.country=SW

“Or” command is not working for this, any suggestions team ?

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you using "OR" - this has to be all in caps for it to work.

Request.countrycode=EU OR Request.country=SW
0 Karma

aaa2324
Explorer

Thanks, but how to get the stats count of these two values?

Stats count by Request.countrycode, Request.country

is not returning any values 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share some anonymised sample events and the current search you are working with, and some idea of what you are trying to get out of it?

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...