Splunk Search

How to use OR operator between subsearch and fields?

splunkxorsplunk
Explorer

Hey Splunkers,

 

I have the following search but it is not working as expected. What I am trying to achieve is if one of the conditions matches I will table out some fields.

condition 1 : if user_action="Update*"

OR 

Condition 2:  within each 5 min bucket, if any user has access more than 400 destination in the same index, index1

but it doesn't work. How can I check both condition on the same search? 

Thanks in advanced!

 

 

index=index1
``` condition 1 ```
( user_action="Update*" )

OR
``` condition 2 ```
(
[search index=index1 NOT user IN ("system*", "nobody*")
| bin _time span=5m
| stats values(dest) count by _time, user
| where count > 400 ]
)

| table _time, user, dest

 

 

 

Labels (2)
0 Karma
1 Solution

johnhuang
Motivator

Either one of these:

index=index1 user_action="Update"
| append [search index=index1 NOT user IN ("system*", "nobody*")
| bucket _time span=5m
| stats count as event_ct values(dest) AS dest BY _time user
| where count>400]
| table _time user dest

index=index1
| bucket _time span=5m
| eventstats count AS event_ct BY _time user
| search event_ct>400 OR user_action="Update"
| table _time user dest

View solution in original post

splunkxorsplunk
Explorer

It worked! Thanks Johnhuang!

johnhuang
Motivator

Just literally replace the or with

 | append 

And remove the next set of parentheses 

0 Karma

splunkxorsplunk
Explorer

Thanks for quick reply! but it didn't work

0 Karma

johnhuang
Motivator

Either one of these:

index=index1 user_action="Update"
| append [search index=index1 NOT user IN ("system*", "nobody*")
| bucket _time span=5m
| stats count as event_ct values(dest) AS dest BY _time user
| where count>400]
| table _time user dest

index=index1
| bucket _time span=5m
| eventstats count AS event_ct BY _time user
| search event_ct>400 OR user_action="Update"
| table _time user dest
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...