Splunk Search

Need help on subsearch

wang
Path Finder

I have a log statement that looks list this: ipAddress=1.2.3.4,userId=42,productId=24

Currently I manually first search "ipAddress=" AND "userId=" AND "productId=" to pull out the 3 values. Then I search for the union of these fields: search "ipAddress=1.2.3.4" OR "userId=42" OR "productId=24".

How can I automated this two searches? I tried following the subsearch example but it's not working.

Tags (1)
0 Karma

hulahoop
Splunk Employee
Splunk Employee

Hi Alice,

Have you tried something like this?

* [search ipAddress=123 AND userId=123 AND productId=123 | fields + ipAddress,userId,productId | format "(" "(" "OR" ")" "OR" ")"]

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...