Splunk Search

Search is returning unwanted data.

jsven7
Communicator
index=myindex server="server1234" OR "server1235" OR "server1236" OR "server1237" OR "server1238" | stats count(_raw) by server

results:
server1234
server123456 <----- why am I getting this?
server1235
server1236
server1237
server1238
server12347 <----- why am I getting this?
server12348 <----- why am I getting this?
server123890 <----- why am I getting this?

How do I only get in return what I asked for? Thanks in advanced.

0 Karma
1 Solution

cmerriman
Super Champion

those are open strings. try this:

index=myindex server="server1234" OR server="server1235" OR server="server1236" OR server="server1237" OR server="server1238" | stats count(_raw) by server

or if you have splunk 6.6:

index=myindex server IN ("server1234" ,"server1235","server1236", "server1237", "server1238") | stats count(_raw) by server

View solution in original post

0 Karma

cmerriman
Super Champion

those are open strings. try this:

index=myindex server="server1234" OR server="server1235" OR server="server1236" OR server="server1237" OR server="server1238" | stats count(_raw) by server

or if you have splunk 6.6:

index=myindex server IN ("server1234" ,"server1235","server1236", "server1237", "server1238") | stats count(_raw) by server
0 Karma

jsven7
Communicator

I see. thank you sir.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@cmerriman - I believe you are missing a close paren in the splunk 6.6 example.

0 Karma

jsven7
Communicator

i don't see that.

0 Karma

jsven7
Communicator

oh you must've edited it before I saw.

0 Karma

cmerriman
Super Champion

thanks @DalJeanis . i was missing a quote too...just have really hit backspace on accident a few times.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...