Splunk Search

regex multiple phrases

New Member

I want to see if string a and string b are in the logs, but they might not be in the same event.
And I don't want to create seperate query for each string.
How do I do that?

Tags (2)
0 Karma


Well, if string a and string b are actual strings (not regular expressions), then this will work

"a" OR "b"

It would be nice to include a sourcetype, source, etc. in the above search, to make it more targeted and efficient. If the strings are regular expresssions, then use this:

| where match(_raw,"a") OR match(_raw,"b")

In this case, you will have to write some search that retrieves a set of data before applying the regular expression filter. While you could use the regex command instead of the where command, I often find this way easier. With regex, you need to write a single regular expression. Combining "a" and "b" might be difficult or hard to understand.


I'm sure that's possible, got some sample data and desired results?

0 Karma