Splunk Search

Keep a search from excluding results

pepper_seattle
Path Finder

I have a search which pulls from two different sourcetypes on the same index. In this search I specifically call out '| search <field>=blah', however only one of the sourcetypes contains that field so the search effectively excludes all data from the other sourcetype.

As I have to keep my search setup like so 'index=blah sourcetype=1 OR sourcetype=2 |...| stats count by sourcetype' I cannot simply append them together like I'd hoped. Additionally, searching for my field parameter in that setup does the same exclusion of data, ex: index=blah sourcetype=1 field="blah" OR sourcetype=2 | ...| stats count by sourcetype'.

My question being, is there a way to run this query with my specific field search that won't exclude the data from the second sourcetype?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

If I understand you correctly, like this (using parentheses to ensure proper logic):

index=blah ((sourcetype=1 field="blah") OR (sourcetype=2)) | ...| stats count by sourcetype'

View solution in original post

0 Karma

pepper_seattle
Path Finder

Thanks to both of you!

0 Karma

acharlieh
Influencer

There are a few options. Parenthesis is one option... e.g.

index=blah ( (sourcetype=1 field="blah") OR sourcetype=2 ) | ... | stats count by sourcetype

Another option may be multisearch

| multisearch [search index=blah sourcetype=1 field="blah"] [search index=blah sourcetype=2] | ... | stats count by sourcetype

(multisearch is cooler when you have different streaming commands to apply to each subsearch.)

0 Karma

woodcock
Esteemed Legend

If I understand you correctly, like this (using parentheses to ensure proper logic):

index=blah ((sourcetype=1 field="blah") OR (sourcetype=2)) | ...| stats count by sourcetype'
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...