Splunk Search

How to search for two groups of field values?

arrowecssupport
Communicator

So I've got 2 different values I'm trying to use; letters & numbers. I want to be able to say

If letters = a b or c & numbers = 1 2 or 3

index = test letters = "a" OR letters = "b" OR letters = "c" AND numbers = "1" or numbers = "2" OR numbers = "3"

I don't think this is quite right. Any ideas?

0 Karma

woodcock
Esteemed Legend

You need parentheses:

 index = test (letters = "a" OR letters = "b" OR letters = "c") AND (numbers = "1" or numbers = "2" OR numbers = "3")
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...