Setting several independent AND/OR conditions on single search

[jpawloski]

I'm running a search against a single index and sourcetype for events that have slightly different data. I want to set conditions as follows but I can't seem to ever get the second set of conditions read:

 index=this sourcetype=that Field_01=65 (CONNECTION_TYPE=TCP AND ROW_COUNT > 0) OR (CONNECTION_TYPE=FTP AND BYTES_SENT > 0) | ...

When run, I only see the first CONNECTION_TYPE in my events. I would use the CONNECTION_TYPE=THIS OR THAT but I have that field that isn't shared by both sets of conditions. What's the cleanest way to do this?

[woodcock · Accepted solution]

Try this (note the insertion of double-quotes and parentheses):

  index=this AND sourcetype="that" AND Field_01="65" AND ((CONNECTION_TYPE="TCP" AND ROW_COUNT > 0) OR (CONNECTION_TYPE="FTP" AND BYTES_SENT > 0))
| ...

[jpawloski]

I had hoped one day to be graced with a reply from woodcock. That day has come. Thanks man!

[woodcock]

I do aim to please! Whenever you are mixing AND and OR, you must use parentheses appropriately or you will go off track quickly.

[HiroshiSatoh]

I think that the search sentence is not wrong.
It will be like this.

 index=this AND sourcetype=that AND Field_01=65  
     AND ((CONNECTION_TYPE=TCP AND ROW_COUNT > 0) OR (CONNECTION_TYPE=FTP AND BYTES_SENT > 0) )| ...