Search Condition in index

[chuck_life09]

Hi,

I want to search the index with the eventtype which has "service" or "window" in the value

index=sdsf | search eventtype="*service*" or "*window*"  | stats count by eventtype

this is not working. can you help if the OR will work or not.

[gcusello]

HI @chuck_life09,

try to put the search conditions as in the main search as possible:

index=sdsf (eventtype="*service*" OR eventtype="*window*")  
| stats count by eventtype

Ciao.

Giuseppe

[ITWhisperer · Accepted solution]

How is it not working? No results or wrong results?

index=sdsf | search eventtype="*service*" or eventtype="*window*"  | stats count by eventtype

[chuck_life09]

Hi,

@ITWhisperer 

Thank you this worked, it dint show me results that were pertaining to "service" or "window". now it is showing me the events which has either of those 2 words.