Splunk Search

Search Condition in index

chuck_life09
Path Finder

Hi,

I want to search the index with the eventtype which has "service" or "window" in the value

index=sdsf | search eventtype="*service*" or "*window*"  | stats count by eventtype

this is not working. can you help if the OR will work or not.

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
Ultra Champion

How is it not working? No results or wrong results?

index=sdsf | search eventtype="*service*" or eventtype="*window*"  | stats count by eventtype

View solution in original post

gcusello
SplunkTrust
SplunkTrust

HI @chuck_life09,

try to put the search conditions as in the main search as possible:

index=sdsf (eventtype="*service*" OR eventtype="*window*")  
| stats count by eventtype

Ciao.

Giuseppe

0 Karma

ITWhisperer
Ultra Champion

How is it not working? No results or wrong results?

index=sdsf | search eventtype="*service*" or eventtype="*window*"  | stats count by eventtype

View solution in original post

chuck_life09
Path Finder

Hi,

@ITWhisperer 

Thank you this worked, it dint show me results that were pertaining to "service" or "window". now it is showing me the events which has either of those 2 words.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!