Splunk Search

Is there a better way to write OR statements in a Splunk search?


Is there a better way to do an OR in Splunk?


api_domain="purchase" OR api_domain="user" OR api_domain="testX"

I assume there is something like api_domain="x" OR "y" OR "z" but but doesn't seem to fly.

0 Karma

Esteemed Legend

Also, if you are after the base search (post-pipe) and don't care about doing this work non-map-reduced (only at the search head), you can do things like this:

... | regex api_domain="^(purchase|user|testX)$"
... | where match(api_domain, "^(purchase|user|testX)$")
0 Karma

Esteemed Legend

That is the normal way and I do not see much reason to deviate.

Let's say that you have a long list of things in a single string or field, you can do it like this:

This part creates a string of sufff (purely for creating something to demonstrate upon):

| noop | stats count AS api_domain | eval api_domain = "purchase, user, testX"

Then you can do something like this:

| makemv delim="," api_domain | format

Then you can use it in outer search like this:

index = blah [| noop | stats count AS api_domain | eval api_domain = "purchase, user, testX" | makemv delim="," api_domain]
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...