Splunk Search

Search is returning unwanted data.

jsven7
Communicator
index=myindex server="server1234" OR "server1235" OR "server1236" OR "server1237" OR "server1238" | stats count(_raw) by server

results:
server1234
server123456 <----- why am I getting this?
server1235
server1236
server1237
server1238
server12347 <----- why am I getting this?
server12348 <----- why am I getting this?
server123890 <----- why am I getting this?

How do I only get in return what I asked for? Thanks in advanced.

0 Karma
1 Solution

cmerriman
Super Champion

those are open strings. try this:

index=myindex server="server1234" OR server="server1235" OR server="server1236" OR server="server1237" OR server="server1238" | stats count(_raw) by server

or if you have splunk 6.6:

index=myindex server IN ("server1234" ,"server1235","server1236", "server1237", "server1238") | stats count(_raw) by server

View solution in original post

0 Karma

cmerriman
Super Champion

those are open strings. try this:

index=myindex server="server1234" OR server="server1235" OR server="server1236" OR server="server1237" OR server="server1238" | stats count(_raw) by server

or if you have splunk 6.6:

index=myindex server IN ("server1234" ,"server1235","server1236", "server1237", "server1238") | stats count(_raw) by server

View solution in original post

0 Karma

jsven7
Communicator

I see. thank you sir.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@cmerriman - I believe you are missing a close paren in the splunk 6.6 example.

0 Karma

jsven7
Communicator

i don't see that.

0 Karma

jsven7
Communicator

oh you must've edited it before I saw.

0 Karma

cmerriman
Super Champion

thanks @DalJeanis . i was missing a quote too...just have really hit backspace on accident a few times.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!