Splunk Search

OR function

Lennard
Engager

Hi guys,

 

I started today with Splunk and have one question.

 

I want to use an or function that if the second "or" the third row is active I got the trigger.

 

Any ideas how to do it?

| eval last_backup_t =strptime(last_backup, "%Y-%m-%d %H:%M:%S.%N%z")

| where last_backup_t < relative_time(now(), "-2d@d")

| search is_offline= true


Thanks

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

OR is usually placed between predicates in a logical evaluation, e.g. as part of a where command.

Splunk works on a pipeline of events and you can't compare between events (without bringing them together in a correlated event).

Alerts can be triggered based on expressions, for example, number of events left in the pipeline, so perhaps you need to fashion a search which returns the events you are interested in and trigger on the presence of these events?

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

OR is usually placed between predicates in a logical evaluation, e.g. as part of a where command.

Splunk works on a pipeline of events and you can't compare between events (without bringing them together in a correlated event).

Alerts can be triggered based on expressions, for example, number of events left in the pipeline, so perhaps you need to fashion a search which returns the events you are interested in and trigger on the presence of these events?

Lennard
Engager

Thanks, I just tried:

| where last_backup_t < relative_time(now(), "-1d@d-4h") or is_offline="true"



So i didn´t need the "search", sometimes the resolution is easier than you think... 😄

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...