Splunk Search

Is there a better way to write OR statements in a Splunk search?


Is there a better way to do an OR in Splunk?


api_domain="purchase" OR api_domain="user" OR api_domain="testX"

I assume there is something like api_domain="x" OR "y" OR "z" but but doesn't seem to fly.

0 Karma

Esteemed Legend

Also, if you are after the base search (post-pipe) and don't care about doing this work non-map-reduced (only at the search head), you can do things like this:

... | regex api_domain="^(purchase|user|testX)$"
... | where match(api_domain, "^(purchase|user|testX)$")
0 Karma

Esteemed Legend

That is the normal way and I do not see much reason to deviate.

Let's say that you have a long list of things in a single string or field, you can do it like this:

This part creates a string of sufff (purely for creating something to demonstrate upon):

| noop | stats count AS api_domain | eval api_domain = "purchase, user, testX"

Then you can do something like this:

| makemv delim="," api_domain | format

Then you can use it in outer search like this:

index = blah [| noop | stats count AS api_domain | eval api_domain = "purchase, user, testX" | makemv delim="," api_domain]
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...