Search for multiple keywords.

[ykmohank]

Hi,

I want to do a search having multiple strings.

Example: Consider,I am looking for SearchKey1 and SerachKey2

In SQL i will write something like this

Select * from Table_Name where ColumnName like '%SearchKey1%' and ColumnName like '%SerachKey2%'

IN SQL the above query returns me all the rows having both search keys SearchKey1 and SearchKey2 in it.

I want to achieve similiar kind of search in SPLUNK. Please help me with appropriate code.

[MuS]

Hi ykmohank,

as always docs is your friend, read this guide for SQL users.

cheers, MuS

[MuS]

but I give you some hint:

source=_Name ColumnName="*SearchKey1*" ColumnName="*SearchKey2*"
or
index=_Name ColumnName="*SearchKey1*" ColumnName="*SearchKey2*"

[adminpulse]

its not working