Splunk Search

Splunk Search - 'OR' operator is missing a clause on the right hand side

cyler
New Member

Issue, here is my search

index=my_index EventSubType="Computer Modified"

NOT UserName="System"

"HostIP=172.16.1." OR
"HostIP=172.16.4.
" OR
"HostIP=172.16.5.*" OR

| table _time EventSubType UserName HostIP HostName Message

Here is my error - Error in 'search' command: Unable to parse the search: 'OR' operator is missing a clause on the right hand side.

Please help, thank you

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Remove the third superfluous OR from your search.

View solution in original post

0 Karma

cyler
New Member

Thank you very much for the help. I am able to get the results I need.

0 Karma

kmaron
Motivator

You have an extra OR and you should probably have parentheses if I am reading your intentions correctly.

index=my_index EventSubType="Computer Modified"
NOT UserName="System"  
("HostIP=172.16.1." OR  "HostIP=172.16.4." OR "HostIP=172.16.5.*")    
| table _time EventSubType UserName HostIP HostName Message

With the order of processing and implied ANDs your OR's will not work correctly without the parentheses

0 Karma

cyler
New Member

Very helpful thank you

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Not quite, the parentheses there are optional. In SPL operator precedence, these two searches are equivalent:

| makeresults | eval a = "1 2", b = "2 3" | makemv a | mvexpand a | makemv b | mvexpand b | search a=1 b=2 OR b=3

| makeresults | eval a = "1 2", b = "2 3" | makemv a | mvexpand a | makemv b | mvexpand b | search a=1 (b=2 OR b=3)
0 Karma

kmaron
Motivator

Apparently I was taught wrong. Thanks for the info.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Remove the third superfluous OR from your search.

0 Karma

cyler
New Member

Worked thank you!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...