Splunk Search

regex multiple phrases

lucychang2015
New Member

I want to see if string a and string b are in the logs, but they might not be in the same event.
And I don't want to create seperate query for each string.
How do I do that?

Tags (2)
0 Karma

lguinn2
Legend

Well, if string a and string b are actual strings (not regular expressions), then this will work

"a" OR "b"

It would be nice to include a sourcetype, source, etc. in the above search, to make it more targeted and efficient. If the strings are regular expresssions, then use this:

yoursearchhere
| where match(_raw,"a") OR match(_raw,"b")

In this case, you will have to write some search that retrieves a set of data before applying the regular expression filter. While you could use the regex command instead of the where command, I often find this way easier. With regex, you need to write a single regular expression. Combining "a" and "b" might be difficult or hard to understand.

martin_mueller
SplunkTrust
SplunkTrust

I'm sure that's possible, got some sample data and desired results?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...