Splunk Search

OR function

Lennard
Engager

Hi guys,

 

I started today with Splunk and have one question.

 

I want to use an or function that if the second "or" the third row is active I got the trigger.

 

Any ideas how to do it?

| eval last_backup_t =strptime(last_backup, "%Y-%m-%d %H:%M:%S.%N%z")

| where last_backup_t < relative_time(now(), "-2d@d")

| search is_offline= true


Thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OR is usually placed between predicates in a logical evaluation, e.g. as part of a where command.

Splunk works on a pipeline of events and you can't compare between events (without bringing them together in a correlated event).

Alerts can be triggered based on expressions, for example, number of events left in the pipeline, so perhaps you need to fashion a search which returns the events you are interested in and trigger on the presence of these events?

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

OR is usually placed between predicates in a logical evaluation, e.g. as part of a where command.

Splunk works on a pipeline of events and you can't compare between events (without bringing them together in a correlated event).

Alerts can be triggered based on expressions, for example, number of events left in the pipeline, so perhaps you need to fashion a search which returns the events you are interested in and trigger on the presence of these events?

Lennard
Engager

Thanks, I just tried:

| where last_backup_t < relative_time(now(), "-1d@d-4h") or is_offline="true"



So i didn´t need the "search", sometimes the resolution is easier than you think... 😄

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...