Splunk Search

Were to use where and when to use OR when to use AND

MeMilo09
Path Finder

Hi Guys, 

I am novice somewhat, and confusion has struck.

Where does the | where clause go in the query? Is it before stats typically or after, end of query? 

Also, AND -- I understand to use this when I want for example both burger and fries -- so like I want my results to show me both burger and fries so I would query - (burger AND fries)  ---- or is this OR instead of and? When would I use OR instead ? 

Would like just some brief examples. Thanks in advance 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @MeMilo09,

about the where command, you can find all the information at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

In few words, it's usually used when you have to check the result (true or false) of an eval condition (e.g. | where value>100).

About the boolean operators, you can find more information at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/UnderstandingSPLsyntax#Boolean_op...

in few words: OR must be always used, instead AND isn't mandatory in a search, but it's mandatory in the conditions (e.g. in eval command).

Put attention to the difference between NOT and != https://docs.splunk.com/Documentation/Splunk/8.2.0/Search/NOTexpressions

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @MeMilo09,

about the where command, you can find all the information at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where

In few words, it's usually used when you have to check the result (true or false) of an eval condition (e.g. | where value>100).

About the boolean operators, you can find more information at https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/UnderstandingSPLsyntax#Boolean_op...

in few words: OR must be always used, instead AND isn't mandatory in a search, but it's mandatory in the conditions (e.g. in eval command).

Put attention to the difference between NOT and != https://docs.splunk.com/Documentation/Splunk/8.2.0/Search/NOTexpressions

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @MeMilo09,

good for you,see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...