Splunk Search

OR function

Lennard
Engager

Hi guys,

 

I started today with Splunk and have one question.

 

I want to use an or function that if the second "or" the third row is active I got the trigger.

 

Any ideas how to do it?

| eval last_backup_t =strptime(last_backup, "%Y-%m-%d %H:%M:%S.%N%z")

| where last_backup_t < relative_time(now(), "-2d@d")

| search is_offline= true


Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OR is usually placed between predicates in a logical evaluation, e.g. as part of a where command.

Splunk works on a pipeline of events and you can't compare between events (without bringing them together in a correlated event).

Alerts can be triggered based on expressions, for example, number of events left in the pipeline, so perhaps you need to fashion a search which returns the events you are interested in and trigger on the presence of these events?

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

OR is usually placed between predicates in a logical evaluation, e.g. as part of a where command.

Splunk works on a pipeline of events and you can't compare between events (without bringing them together in a correlated event).

Alerts can be triggered based on expressions, for example, number of events left in the pipeline, so perhaps you need to fashion a search which returns the events you are interested in and trigger on the presence of these events?

Lennard
Engager

Thanks, I just tried:

| where last_backup_t < relative_time(now(), "-1d@d-4h") or is_offline="true"



So i didn´t need the "search", sometimes the resolution is easier than you think... 😄

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...