Splunk Search

OR connection with missing fileds

alex_kh
Explorer

Hello Folks, i have folowing question
I have folowing search

index=indexA OR index=indexB OR indexC user=alex OR ip=255.255.255.255 OR os= win95|table user ip os index

i expect (and i need) folowing result

alex null win95 indexA
alex 255.255.255.255 win95 indexB
null null win95 index C

curently i have
alex 255.255.255.255 win95 indexB
simon 0.0.0.0 linux indexB
betty 0.0.0.1 mac indexB

what am i doing wrong?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to see sample events.
Adding parentheses to your query will help tell Splunk how to interpret your desires. For exanple, (index=indexA OR index=indexB OR indexC) (user=alex OR ip=255.255.255.255 OR os= win95)|....

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishalipaka
Motivator

@alex_kh

strings are encoded with "index1" or 'mac'

Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...