Splunk Search

filter using where command with AND & OR operators.

man03359
Communicator

I have two fields (lets say.) AA and BB, I am trying to filter our results where AA and BB = 00 OR 10 using something like this -

index="idx-some-index" sourcetype="dbx" source="some.*.source"
| where (AA AND BB)== (00 OR 10)

But I am getting error as Error in 'where' command: Type checking failed. 'AND' only takes boolean arguments.

I have also tried -

index="idx-some-index" sourcetype="dbx" source="some.*.source"
| where AA =(00 OR 10) AND (BB=(OO OR 10))

But I am getting same error as Type checking failed. 'OR' only takes boolean arguments.

 

Please help!

Labels (2)
0 Karma
1 Solution

man03359
Communicator

Nevermind! 

I was able to get the desired output by using -

| where (AA ="00" OR AA="10") OR (BB="00" OR BB="10")

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @man03359,

You can use the below syntax;

index="idx-some-index" sourcetype="dbx" source="some.*.source" AA IN (00,10) BB IN (00,10)

  or

index="idx-some-index" sourcetype="dbx" source="some.*.source" (AA=00 OR AA=10) (BB=00 OR BB=10)

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

man03359
Communicator

@scelikok Yes I tried out with -

|where AA IN ('00','10') AND BB IN ('00','10') 

But it was not giving any output, but the second one did worked :0

 

Thanks 🙂

0 Karma

man03359
Communicator

Nevermind! 

I was able to get the desired output by using -

| where (AA ="00" OR AA="10") OR (BB="00" OR BB="10")
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...