Hello Folks, i have folowing question
I have folowing search
index=indexA OR index=indexB OR indexC user=alex OR ip=255.255.255.255 OR os= win95|table user ip os index
i expect (and i need) folowing result
alex null win95 indexA
alex 255.255.255.255 win95 indexB
null null win95 index C
curently i have
alex 255.255.255.255 win95 indexB
simon 0.0.0.0 linux indexB
betty 0.0.0.1 mac indexB
what am i doing wrong?
It would help to see sample events.
Adding parentheses to your query will help tell Splunk how to interpret your desires. For exanple, (index=indexA OR index=indexB OR indexC) (user=alex OR ip=255.255.255.255 OR os= win95)|...
.
@alex_kh
strings are encoded with "index1"
or 'mac'