Searching with AND OR

[jlaigo2]

I am trying to setup a dashboard with the following example search. What I need to do is have both id and or name, I tried it with just OR but if it matches on the first it will not continue on the second and it breaks with AND OR...?

index=someindex id=* AND OR name=*

[markthompson]

lpolo has the correct answer, but I thought I'd clarify a bit.

The operators match criteria, so:

AND - is used in the format if(id=? AND name=?,TRUE, FALSE) so both criteria, working on a boolean basis, should return 1, then it will carry on and return true.

OR - is used in the format if(id=? OR name=?, TRUE, FALSE) so it will continue if either of the fields match

What you're attempting to do, is to check if the ID matches, or the name matches, then you wish to display the ID and the Name, so you should be using the OR; index=yourindex id=? OR name=? | table _time, id, name

Hope that cleared things up.

[lpolo]

with AND you get this result set

id | name | expected result
----------------------------
no | no | none are reported
yes | no | none are reported
no| yes | none are reported
yes | yes | Both are reported

OR

id | name | expected result
----------------------------------
no | no | none are reported
yes | no | id is reported
no| yes | name is reported
yes | yes | Both  name and id are reported

Based on these premises you want to use OR

index=someindex id OR name|table _time id name