Splunk Search

Multiple searches on the same field?

whucks
Engager

Is it possible to perform multiple searches on the same field? For reporting purposes I want to search for all values less than zero, equal to zero, and greater than zero.

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Sure.. just use OR

my awesome search terms AND ( foo=0 OR foo>200 OR foo <5 )

Now, if you're wanting to do some distribution analysis, it might be more like

my awesome search terms | eval disposition=case(foo < 0, "Lessthanzero", 
foo=0 , "EqualZero", 
foo > 0, "GreaterThanZero") 
| stats count(_raw) by disposition

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Sure.. just use OR

my awesome search terms AND ( foo=0 OR foo>200 OR foo <5 )

Now, if you're wanting to do some distribution analysis, it might be more like

my awesome search terms | eval disposition=case(foo < 0, "Lessthanzero", 
foo=0 , "EqualZero", 
foo > 0, "GreaterThanZero") 
| stats count(_raw) by disposition

rps462
Path Finder

If this isn't working for you .. it's ok, you're not crazy. Chances are you have "or" instead of "OR". Make sure it's capitalized.

0 Karma

whucks
Engager

Thank you very much for your answer to my question. Your solution worked perfectly.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...