Splunk Search

Using subsearch we can pull several fields to main search, but the returned fields will be by default run with AND condition. Is there a way to pull multiple fields and run with OR condition ?

Uday_Gonti
New Member

Ex:
sourcetype=abcd [search sourcetype=xyz field1=200 | table field2,field3,field4] which will be literally

sourcetype=abcd [search field2="returned value" AND field3="returned value" AND field4="returned value" ]

Is it possible to run

sourcetype=abcd [search field2="returned value" OR field3="returned value" OR field4="returned value"]

given that the field name conventions are same in both the sourcetypes.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You can fully control the logic of a subsearch by appending on to the end of it the format command:

http://docs.splunk.com/Documentation/Splunk/latest/Search/Changetheformatofsubsearchresults
In your case, though, just do this:

sourcetype=abcd [search sourcetype=xyz field1=200 | stats count by field2,field3,field4 | fields - count]

BY default, everything IN a row gets merged with an AND and then everything ACROSS rows gets merged with an OR. Your original search was all one row, thus it got AND; my search is 3 rows, thus it gets OR.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can fully control the logic of a subsearch by appending on to the end of it the format command:

http://docs.splunk.com/Documentation/Splunk/latest/Search/Changetheformatofsubsearchresults
In your case, though, just do this:

sourcetype=abcd [search sourcetype=xyz field1=200 | stats count by field2,field3,field4 | fields - count]

BY default, everything IN a row gets merged with an AND and then everything ACROSS rows gets merged with an OR. Your original search was all one row, thus it got AND; my search is 3 rows, thus it gets OR.

0 Karma

deepashri_123
Motivator

Hey@Uday_Gonti,

You can try running this:
sourcetype=abcd field2="abc" OR field3="xyz" OR field4="vbg"

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...