Splunk Search

OR connection with missing fileds

alex_kh
Explorer

Hello Folks, i have folowing question
I have folowing search

index=indexA OR index=indexB OR indexC user=alex OR ip=255.255.255.255 OR os= win95|table user ip os index

i expect (and i need) folowing result

alex null win95 indexA
alex 255.255.255.255 win95 indexB
null null win95 index C

curently i have
alex 255.255.255.255 win95 indexB
simon 0.0.0.0 linux indexB
betty 0.0.0.1 mac indexB

what am i doing wrong?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to see sample events.
Adding parentheses to your query will help tell Splunk how to interpret your desires. For exanple, (index=indexA OR index=indexB OR indexC) (user=alex OR ip=255.255.255.255 OR os= win95)|....

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishalipaka
Motivator

@alex_kh

strings are encoded with "index1" or 'mac'

Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...