Splunk Search

OR connection with missing fileds

alex_kh
Explorer

Hello Folks, i have folowing question
I have folowing search

index=indexA OR index=indexB OR indexC user=alex OR ip=255.255.255.255 OR os= win95|table user ip os index

i expect (and i need) folowing result

alex null win95 indexA
alex 255.255.255.255 win95 indexB
null null win95 index C

curently i have
alex 255.255.255.255 win95 indexB
simon 0.0.0.0 linux indexB
betty 0.0.0.1 mac indexB

what am i doing wrong?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to see sample events.
Adding parentheses to your query will help tell Splunk how to interpret your desires. For exanple, (index=indexA OR index=indexB OR indexC) (user=alex OR ip=255.255.255.255 OR os= win95)|....

---
If this reply helps you, an upvote would be appreciated.
0 Karma

harishalipaka
Builder

@alex_kh

strings are encoded with "index1" or 'mac'

A.Harish
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>