combine two searches

[msalghamdi]

Dear Splunker

i need a search that gets me if  theres a host that has these logs, below is a psudeo search that show what i really want:

index=linux host=* sourcetype=bash_history AND ("systemctl start" OR "systemctl enable") | union [search index=linux host=* sourcetype=bash_history (mv AND /opt/ ) ]

just to make more clearer, i want a match only  if a server generated a log that contains "mv AND /opt/" and another log that contains "systemctl start" OR "systemctl enable"

thanks in advance

[msalghamdi]

it worked, thanks Whisperer, a helping hand as alwas

[ITWhisperer · Accepted solution]

Try something like this

index=linux host=* sourcetype=bash_history "systemctl start" OR "systemctl enable" OR (mv /opt/)
| eval systemctl=if(searchmatch("systemctl"), "systemctl",null())
| eval mo_opt=if(searchmatch("mv") AND searchmatch("/opt/"), "mv_opt", null())
| stats dc(mv_opt) as mv_opt dc(systemctl) as systemctl by host
| where mv_opt==1 and systemctl==1