Splunk Search

Output events from two different logs/Session IDs

ferza
Explorer

I have a simple search that goes as such:

sessionid=UNIQIESESSIONID "connected to "

This outputs a single logline/event from the Session log contains the string "connected to "

Is there a way I can output this from two different unique session ID's? I thought I could do something like:

sessionid=UNIQIESESSIONID "connected to " OR sessionid=UNIQIESESSIONID "connected to "

But that did not work. Any suggestions?

Tags (2)
0 Karma
1 Solution

ramdaspr
Contributor

Try

(sessionid=UNIQIESESSIONID OR sessionid=UNIQIESESSIONID ) "connected to " 

View solution in original post

ramdaspr
Contributor

Try

(sessionid=UNIQIESESSIONID OR sessionid=UNIQIESESSIONID ) "connected to " 

View solution in original post

ferza
Explorer

That worked! Thanks!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!