search query filter

[ringbbg]

I have a simple search query to look for vpn alerts

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="*karachi*" KMD_PM_SA_ESTABLISHED OR "IKE negotiation failed with error"

However, I want to make splunk return results of KMD_PM_SA_ESTABLISHED only when the IKE negotiation failed with error is detected beforehand. Is there a way to do it?

Thanks

[woodcock]

Are these 2 conditions contained in the same event or 2 different events?

[inventsekar]

>  I want to make splunk return results
> of KMD_PM_SA_ESTABLISHED only when the
> IKE negotiation failed with error is
> detected beforehand

KMD_PM_SA_ESTABLISHED
and
"IKE negotiation failed with error" ---- these two are appearing on a single event or different events?
as you say "only when the IKE negotiation failed with error is detected beforehand", mostly they would be appearing on the same event. so, simply you can use "AND" instead of the the "OR"

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="karachi" KMD_PM_SA_ESTABLISHED AND "IKE negotiation failed with error"

AND is always implied on the search by default (for example - search for "one two" means, its actually searching for "one AND two")

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="karachi" KMD_PM_SA_ESTABLISHED "IKE negotiation failed with error"

[niketn]

Change OR to AND, which will match both conditions to be true. Even if you take out OR, by default Splunk will use AND.