Splunk Search

Search for multiple keywords.

ykmohank
New Member

Hi,

I want to do a search having multiple strings.

Example: Consider,I am looking for SearchKey1 and SerachKey2

In SQL i will write something like this

Select * from Table_Name where ColumnName like '%SearchKey1%' and ColumnName like '%SerachKey2%'

IN SQL the above query returns me all the rows having both search keys SearchKey1 and SearchKey2 in it.

I want to achieve similiar kind of search in SPLUNK. Please help me with appropriate code.

Tags (3)
0 Karma

MuS
Legend

Hi ykmohank,

as always docs is your friend, read this guide for SQL users.

cheers, MuS

MuS
Legend

but I give you some hint:

source=_Name ColumnName="*SearchKey1*" ColumnName="*SearchKey2*"
or
index=_Name ColumnName="*SearchKey1*" ColumnName="*SearchKey2*"

adminpulse
Loves-to-Learn Lots

its not working

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...