Splunk Search

How to pull events with multiple sourcetype

rakesh44
Communicator

I am searching events with specific multiple sourcetype, but getting extra sourcetype.Kindly refer attached file.

Am searching sourcetype=splunkd OR sourcetype=splunkd_access

index="_internal" sourcetype=splunkd OR sourcetype=splunkd_access OR component=root OR component=Metrics | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count by sourcetype

Tags (1)
0 Karma
1 Solution

splunk_sv
Path Finder

It is due to the OR condition you have in your search query.

index="_internal" sourcetype="splunkd" OR sourcetype="splunkd_access" OR component=root OR component=Metrics | rest  of the search

It will bring all records which satisfies anyone of the condition, and when a record is found with "component=root" it is of sourcetype splunk_web_service.
So, if you don't want records from a particular sourcetype you can either filter that out using where clause or you can update your search to have AND condition as shown in the below command,

index="_internal" sourcetype="splunkd" OR sourcetype="splunkd_access" AND (component=root OR component=Metrics) |rest of the search

View solution in original post

0 Karma

aojie654
Path Finder

I'm agree with @whrg.

In my opinion, I think the boolean operators ( AND, OR, NOT) command should be included in "( )" such as index="_internal" (sourcetype=splunkd OR sourcetype=splunkd_access) (component=root OR component=Metric)
When you are using command "search" without any boolean operators, splunk will fill an AND between the search conditions. For example, index=_internal sourcetype=splunkd is equals that index=_internal AND sourcetype=splunkd.
In your case, sourcetype=* and component=* are not conflicting conditions so maybe you should better to use AND or nothing between them.

0 Karma

splunk_sv
Path Finder

It is due to the OR condition you have in your search query.

index="_internal" sourcetype="splunkd" OR sourcetype="splunkd_access" OR component=root OR component=Metrics | rest  of the search

It will bring all records which satisfies anyone of the condition, and when a record is found with "component=root" it is of sourcetype splunk_web_service.
So, if you don't want records from a particular sourcetype you can either filter that out using where clause or you can update your search to have AND condition as shown in the below command,

index="_internal" sourcetype="splunkd" OR sourcetype="splunkd_access" AND (component=root OR component=Metrics) |rest of the search
0 Karma

whrg
Motivator

I believe you have too many "OR"s.

Try this:

index="_internal" sourcetype=splunkd OR sourcetype=splunkd_access component=root OR component=Metrics | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count by sourcetype

Written differently:

index="_internal" (sourcetype=splunkd OR sourcetype=splunkd_access) AND (component=root OR component=Metrics) | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count by sourcetype
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...