Splunk Search

Setting several independent AND/OR conditions on single search

Path Finder

I'm running a search against a single index and sourcetype for events that have slightly different data. I want to set conditions as follows but I can't seem to ever get the second set of conditions read:

 index=this sourcetype=that Field_01=65 (CONNECTION_TYPE=TCP AND ROW_COUNT > 0) OR (CONNECTION_TYPE=FTP AND BYTES_SENT > 0) | ...

When run, I only see the first CONNECTION_TYPE in my events. I would use the CONNECTION_TYPE=THIS OR THAT but I have that field that isn't shared by both sets of conditions. What's the cleanest way to do this?

0 Karma
1 Solution

Esteemed Legend

Try this (note the insertion of double-quotes and parentheses):

  index=this AND sourcetype="that" AND Field_01="65" AND ((CONNECTION_TYPE="TCP" AND ROW_COUNT > 0) OR (CONNECTION_TYPE="FTP" AND BYTES_SENT > 0))
| ...

View solution in original post

Esteemed Legend

Try this (note the insertion of double-quotes and parentheses):

  index=this AND sourcetype="that" AND Field_01="65" AND ((CONNECTION_TYPE="TCP" AND ROW_COUNT > 0) OR (CONNECTION_TYPE="FTP" AND BYTES_SENT > 0))
| ...

View solution in original post

Path Finder

I had hoped one day to be graced with a reply from woodcock. That day has come. Thanks man!

Esteemed Legend

I do aim to please! Whenever you are mixing AND and OR, you must use parentheses appropriately or you will go off track quickly.

0 Karma

Champion

I think that the search sentence is not wrong.
It will be like this.

 index=this AND sourcetype=that AND Field_01=65  
     AND ((CONNECTION_TYPE=TCP AND ROW_COUNT > 0) OR (CONNECTION_TYPE=FTP AND BYTES_SENT > 0) )| ...
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!