Search is returning unwanted data.

[jsven7]

index=myindex server="server1234" OR "server1235" OR "server1236" OR "server1237" OR "server1238" | stats count(_raw) by server

results:
server1234
server123456 <----- why am I getting this?
server1235
server1236
server1237
server1238
server12347 <----- why am I getting this?
server12348 <----- why am I getting this?
server123890 <----- why am I getting this?

How do I only get in return what I asked for? Thanks in advanced.

[cmerriman · Accepted solution]

those are open strings. try this:

index=myindex server="server1234" OR server="server1235" OR server="server1236" OR server="server1237" OR server="server1238" | stats count(_raw) by server

or if you have splunk 6.6:

index=myindex server IN ("server1234" ,"server1235","server1236", "server1237", "server1238") | stats count(_raw) by server

[jsven7]

I see. thank you sir.

[DalJeanis]

@cmerriman - I believe you are missing a close paren in the splunk 6.6 example.

[jsven7]

i don't see that.

[jsven7]

oh you must've edited it before I saw.

[cmerriman]

thanks @DalJeanis . i was missing a quote too...just have really hit backspace on accident a few times.