Splunk Search

OR conditional combination show less events

jnahuelperez35
Path Finder

Hi Guys! It's me again!
A few days ago i was asking how can i eval some fields and get the total from them. Now i want to show those in a table format and for that, i made this search:

index=MY_INDEX (FIRST_ACT=5 AND SECOND_ACT=2) OR (FIRST_ACT=5 and SECOND_ACT=4 and STAT_FLAG=0) OR (FIRST_ACT=5 and SECOND_ACT=4 and STAT_FLAG=4).

This search returns 10 events, but, in fact, there 14 events. How i know that? Because i have another panel that show's me the same events, but with and eval expression and a Single Value accumulation:

MySearch | eval UTCOD=if((FIRST_ACT=5 and SECOND_ACT=2), 1, 0) | eval UTCOQ=if((FIRST_ACT=5) and (SECOND_ACT=4) and (STAT_FLAG=0), 1, 0) | eval UTSQ=if((FIRST_ACT=5) and (SECOND_ACT=4) and (STAT_FLAG=4), 1, 0) |  eval all_UT=UTCOD+UTCOQ+UTSQ | status sum(all_UT) as total

So ...why is that? Why when i search with OR conditional the result is 10, but when the search is made with EVAL founds 14 events?

Thanks a lot for help.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think the order in which each expression is evaluated may be affecting the results. Try this.

index=MY_INDEX ((FIRST_ACT=5 AND SECOND_ACT=2) OR (FIRST_ACT=5 AND SECOND_ACT=4 AND STAT_FLAG=0) OR (FIRST_ACT=5 AND SECOND_ACT=4 AND STAT_FLAG=4))
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I think the order in which each expression is evaluated may be affecting the results. Try this.

index=MY_INDEX ((FIRST_ACT=5 AND SECOND_ACT=2) OR (FIRST_ACT=5 AND SECOND_ACT=4 AND STAT_FLAG=0) OR (FIRST_ACT=5 AND SECOND_ACT=4 AND STAT_FLAG=4))
---
If this reply helps you, Karma would be appreciated.

jnahuelperez35
Path Finder

OMG!...i feel so noob... All i need was a couple "()" to group all the conditional expression... And i swear that try with that, but surely in the wrong way.

You answer is the solution!

Thanks a lot RichGalloway! Happy New Year from Argentina!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...