Splunk Search

Is there a better way to write OR statements in a Splunk search?

daniel333
Builder

Is there a better way to do an OR in Splunk?

Example:

api_domain="purchase" OR api_domain="user" OR api_domain="testX"

I assume there is something like api_domain="x" OR "y" OR "z" but but doesn't seem to fly.

0 Karma

woodcock
Esteemed Legend

Also, if you are after the base search (post-pipe) and don't care about doing this work non-map-reduced (only at the search head), you can do things like this:

... | regex api_domain="^(purchase|user|testX)$"
... | where match(api_domain, "^(purchase|user|testX)$")
0 Karma

woodcock
Esteemed Legend

That is the normal way and I do not see much reason to deviate.

Let's say that you have a long list of things in a single string or field, you can do it like this:

This part creates a string of sufff (purely for creating something to demonstrate upon):

| noop | stats count AS api_domain | eval api_domain = "purchase, user, testX"

Then you can do something like this:

| makemv delim="," api_domain | format

Then you can use it in outer search like this:

index = blah [| noop | stats count AS api_domain | eval api_domain = "purchase, user, testX" | makemv delim="," api_domain]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...