Splunk Search

OR operator problem

bugnet
Path Finder

Hi all,

Hey, what's wrong with the next search structure?
I'm using OR operator because the field names are different in each index.

(index=fw product=barracuda severity>=5 geo!=Greece)
OR (index=apache msg!=error )
OR (index=nac Name!="pass" Name!="manage" Name!="error")
AND src_ip!=10.0.0.0/8 src_ip!=172.16.0.0/12 src_ip!=192.168.0.0/16

Thanks

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Item 1 - Computer Science 101: mixing ORs and ANDs without specifying order of operation.

Assuming it's what you mean, try:

((index=fw product=barracuda severity>=5 geo!=Greece)
OR (index=apache msg!=error )
OR (index=nac Name!="pass" Name!="manage" Name!="error"))
AND ( rc_ip!=10.0.0.0/8 AND  src_ip!=172.16.0.0/12 AND src_ip!=192.168.0.0/16)

Item 2 - IP specification

For the second phrase, you probably mean...

AND NOT
((src_ip>=10.0.0.0 AND  src_ip<=10.0.0.8 ) OR 
 (src_ip>=172.16.0.0 AND  src_ip<=172.16.0.12 ) OR 
 (src_ip>=192.168.0.0 AND  src_ip<=192.168.0.16 ) )

...except that's not right either, since it's lexicographical comparison, but you get the idea.

Myself, I'd probably break that out into a separate search or regex, as the first verb after the initial search, which might look something like this...

| regex rc_ip!="^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$"

or

| search NOT match(rc_ip,"^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$")

or

| where NOT match(rc_ip,"^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What makes you think something is wrong?

There is a missing '=' before "manage", but I assume that's in the question and not in the query.

---
If this reply helps you, an upvote would be appreciated.
0 Karma