Splunk Search

Multiple searches on the same field?

whucks
Engager

Is it possible to perform multiple searches on the same field? For reporting purposes I want to search for all values less than zero, equal to zero, and greater than zero.

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Sure.. just use OR

my awesome search terms AND ( foo=0 OR foo>200 OR foo <5 )

Now, if you're wanting to do some distribution analysis, it might be more like

my awesome search terms | eval disposition=case(foo < 0, "Lessthanzero", 
foo=0 , "EqualZero", 
foo > 0, "GreaterThanZero") 
| stats count(_raw) by disposition

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Sure.. just use OR

my awesome search terms AND ( foo=0 OR foo>200 OR foo <5 )

Now, if you're wanting to do some distribution analysis, it might be more like

my awesome search terms | eval disposition=case(foo < 0, "Lessthanzero", 
foo=0 , "EqualZero", 
foo > 0, "GreaterThanZero") 
| stats count(_raw) by disposition

rps462
Path Finder

If this isn't working for you .. it's ok, you're not crazy. Chances are you have "or" instead of "OR". Make sure it's capitalized.

0 Karma

whucks
Engager

Thank you very much for your answer to my question. Your solution worked perfectly.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...