Need help on subsearch

[wang]

I have a log statement that looks list this: ipAddress=1.2.3.4,userId=42,productId=24

Currently I manually first search "ipAddress=" AND "userId=" AND "productId=" to pull out the 3 values. Then I search for the union of these fields: search "ipAddress=1.2.3.4" OR "userId=42" OR "productId=24".

How can I automated this two searches? I tried following the subsearch example but it's not working.

[hulahoop]

Hi Alice,

Have you tried something like this?

* [search ipAddress=123 AND userId=123 AND productId=123 | fields + ipAddress,userId,productId | format "(" "(" "OR" ")" "OR" ")"]