If "this AND this" OR "this AND this" then ...

[mgrosholz]

I am looking for a string that will show results for the following:
if (srcIP="x" AND srcPORT="y") OR (destIP="x" AND destPORT="y") then ... [show results] ...

[mgrosholz]

So... the answer below works for this question but, like many things, doesn't work in all cases.

I was trying to do an eval and stats statement but formatting it as so is not pulling the data.
Thus, some searches still need a special way of claiming an if, and string.

When I find it, I will update.

ex.

sourcetype="A" OR sourcetype="B" 
| eval HOST=case(sourcetype="A",host,sourcetype="B",hst2)
| where (method="GET" AND method="HEAD" AND method="OPTIONS" AND method="POST" AND method="PUT" AND method="TRACE" AND method="TRACK") <--this part messes up the results.  I tried an if statement as well.
| stats count(path) as PATH by HOST
| where PATH>=10

[MuS]

Just a little improvement on the search:

ex. sourcetype="A" OR sourcetype="B" 
(method="GET" AND method="HEAD" AND method="OPTIONS" AND method="POST" AND method="PUT" AND method="TRACE" AND method="TRACK") 
| eval HOST=case(sourcetype="A",host,sourcetype="B",hst2)
| stats count(path) as PATH by HOST
| where PATH>=10

Since you're not using the HOST in any of the if and or's, move it to the base search and use the eval on the reduced set of results.

hope this makes sense ...

cheers, MuS

[mgrosholz]

Thanks for the reply. Sadly, I tried that as well. This format pulled no results rather quickly where I should be seeing exactly one.

"method" is the same in both sourcetypes. <--so that isn't the issue.
If I put "method" (or any other field) in an if/case/etc... statement it doesn't pull any results. <--but if I remove the multiple ANDs and only have one "method", results show up.

[sundareshr]

Have you tried where. Try this

base search | where (srcIP="x" AND srcPORT="y") OR (destIP="x" AND destPORT="y") 

[pradeepkumarg · Accepted solution]

You pretty much have answer with in your question. The only pre-requisite is to have those fields extracted already.

index=your_index sourcetype=your_sourcetype (srcIP="x" AND srcPORT="y") OR (destIP="x" AND destPORT="y") 

[mgrosholz]

Oh man. Thank you. I was way over thinking it. Quick response too.