Splunk Search

Using subsearch we can pull several fields to main search, but the returned fields will be by default run with AND condition. Is there a way to pull multiple fields and run with OR condition ?

Uday_Gonti
New Member

Ex:
sourcetype=abcd [search sourcetype=xyz field1=200 | table field2,field3,field4] which will be literally

sourcetype=abcd [search field2="returned value" AND field3="returned value" AND field4="returned value" ]

Is it possible to run

sourcetype=abcd [search field2="returned value" OR field3="returned value" OR field4="returned value"]

given that the field name conventions are same in both the sourcetypes.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You can fully control the logic of a subsearch by appending on to the end of it the format command:

http://docs.splunk.com/Documentation/Splunk/latest/Search/Changetheformatofsubsearchresults
In your case, though, just do this:

sourcetype=abcd [search sourcetype=xyz field1=200 | stats count by field2,field3,field4 | fields - count]

BY default, everything IN a row gets merged with an AND and then everything ACROSS rows gets merged with an OR. Your original search was all one row, thus it got AND; my search is 3 rows, thus it gets OR.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can fully control the logic of a subsearch by appending on to the end of it the format command:

http://docs.splunk.com/Documentation/Splunk/latest/Search/Changetheformatofsubsearchresults
In your case, though, just do this:

sourcetype=abcd [search sourcetype=xyz field1=200 | stats count by field2,field3,field4 | fields - count]

BY default, everything IN a row gets merged with an AND and then everything ACROSS rows gets merged with an OR. Your original search was all one row, thus it got AND; my search is 3 rows, thus it gets OR.

0 Karma

deepashri_123
Motivator

Hey@Uday_Gonti,

You can try running this:
sourcetype=abcd field2="abc" OR field3="xyz" OR field4="vbg"

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...