Splunk Search

Multiple where values

ashishlal82
Explorer

how can I use multiple values in where clause

for ex:index=xyz sourcetype=abc | dedup name | where name="2009-2274" 2009-2271"

This is giving me an error, can I use OR clause to get field values for the above mentioned values

Tags (2)
0 Karma

DalJeanis
Legend

Yes, you can use OR. The actual issue there is probably that you are missing the word OR and missing a quote before the value 2009-2271.

0 Karma

jbanerje
Explorer

Multiple conditions can be checked by the where clause as shown below :

| inputlookup test.csv | where like(field1, "IP") and not like(field2, "Pass")

0 Karma

sundareshr
Legend

Yes, you can use OR, like this where name="abc" OR name="xyz" OR you can use ... | search name="abc" OR name="xyz". Having said that, you should always try to reduce as much as you can in the first (implicit) search command in terms of efficiency. So I would change your query to

index=xyz sourcetype=abc (name="2009-2274" OR name="2009-2271") | dedup name
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...