Splunk Search

How to search my Sonicwall logs for multiple values for the same field?

New Member

Very much a newb looking to get some basic information from my Sonicwall logs. Setting up the search using multiple criteria for the same field in the log file is what I am asking. I have a firewall event m=1079 (failed SSL VPN login) and m=1080 (successful). How does one string criteria with an OR?

Is it also possible to limit what is displayed in the search as well as group and count for output to dashboards?

Any good reading material would also be cool.


0 Karma

Revered Legend

For reading material, Splunk docs is a good place to start

Basic searching

To add one or more criteria in your search (using boolean functions), try likes this
Based on fields

index=foo sourcetype=bar (m=1079 OR m=1080)

String search

index=foo sourcetype=bar ("failed SSL VPN login" OR "successfull") 


If you have the field m already extracted then you can do following

 m=1079 OR m=1080 

You can limit the data using head or tail commands. Below search will return first 10 occurences for m=1079

m=1079 | head 10

You can group the results by using stats

m=1079 OR m=1080 | stats count by m 

Documentation here http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchTutorial/Aboutthesearchapp

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...