Splunk query - multiple values from a field

[verifi81]

Hi everyone. I'm trying to get this query going  with one search but I can't seem to do that. I can only get it to work when I separate into two queries. Here are the two queries.  

Query1:

index=wineventlog NewObjectDN="*OU=blue*" OldObjectDN=*"Rad Users"* signature_id=4147

Query2:

index=wineventlog NewObjectDN="*OU=blue*" OldObjectDN=*"Fad Users"* signature_id=4147

the Field OldObjectDN has multiple values I'm trying to combine into one search. What would the proper syntax be?

[ITWhisperer · Accepted solution]

index=wineventlog NewObjectDN="*OU=blue*" (OldObjectDN=*"Rad Users"* OR OldObjectDN=*"Fad Users"*) AND NOT (OldObjectDN=*"Rad Users"* AND OldObjectDN=*"Fad Users"*) signature_id=4147

[verifi81]

HI Soutamo, If I use your suggestion I get other values of the oldobjectDN that don't match "Rad Users" or "Fad Users". 

I want the search result to ONLY give me events when the OldObjectDN contains either of those two values.

[isoutamo]

If I understand right, you want to implement XOR not OR operation?

As Splunk haven't XOR on SPL (SPL2 have it?) you must write it with NOT AND. In your case it should work like

index=wineventlog NewObjectDN="*OU=blue*" NOT (OldObjectDN=*"Rad Users"* AND OldObjectDN=*"Fad Users"*) signature_id=4147

r. Ismo 

[verifi81]

Because the value "Sad Users" is being returned as well.

Trying to only return these values:

Rad Users
Fad Users

[yuanliu]

Logical OR if the intention is to include both "Rad Users" and "Fad Users" in output.

index=wineventlog NewObjectDN="*OU=blue*" (OldObjectDN=*"Rad Users"* OR OldObjectDN=*"Fad Users"*) signature_id=4147

[verifi81]

Yuanliu,

I'm trying to include either values but not both values.

[yuanliu]

Can you illustrate input data and how the desired output will look like?

[verifi81]

Sure. Suppose I have this:

Field:
OldObjectDN

Possible values:
OU=Rad Users
OU=Fad Users
OU=Sad Users
OU=Bad Users
OU=Mad Users

I only want the search to return events only if OldobjectDN has the values for Rad User OR Fad Users

[verifi81]

I got it. 
I had to do it this way

(OldObjectDN=*"OU=Rad Users"*) OR (OldObjectDN=*"OU=Fad Users"*)

I appreciate the help from both of you.

[isoutamo]

You should try 

index=wineventlog NewObjectDN="*OU=blue*" OldObjectDN IN (*"Rad Users"*, *"Fad Users"*) signature_id=4147