×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
hgoyal
Engager
Member since: ‎08-06-2023
‎08-09-2023
Community Statistics
Posts 7
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎08-06-2023
Activity Feed
View All

Re: Multiple OR not working as expected with AND c...

by in Splunk Search
‎08-09-2023 01:47 AM
‎08-09-2023 01:47 AM
Okay. I have one variable say bucket_name. It exists in eventtype ->First and eventtype->Second  So this is a common field in both the eventtype. But I want to combine these both events so that I have both the bucket names into single eventtype.  And that's why I was trying to perform OR and AND operator. TO extract bucket name value . My use case is I want to Search only the bucketnames which exists with some other specific bucket names using search keyword  ... View more

Re: Multiple OR not working as expected with AND c...

by in Splunk Search
‎08-09-2023 01:30 AM
‎08-09-2023 01:30 AM
Hi,  I tried to combine two different eventtype events in one single event. Eventtype = First and Eventtype =Second  eventtype="First " OR eventtype="Second "| transaction eventtype maxspan=1s | eval combined_event()=mvjoin(event, " ") | table combined_event But it group the events of First and Second it didnt added FIRST+Second into single eventtype is this possible? ... View more

Re: Multiple OR not working as expected with AND c...

by in Splunk Search
‎08-08-2023 11:27 PM
‎08-08-2023 11:27 PM
Hello, I think I know why it is not working. I was trying to make AND work on different events . For example one event has A value And there is another event with B value  And I am trying to apply multiple AND and OR between different events . Is there anyway to apply AND and OR between 2 different events and their values ? ... View more

Re: Multiple OR not working as expected with AND c...

by in Splunk Search
‎08-08-2023 08:45 PM
‎08-08-2023 08:45 PM
There is a single field on which these values are matched. Bucket Name ... View more

Why is multiple OR not working as expected with AN...

by in Splunk Search
‎08-08-2023 03:23 AM
‎08-08-2023 03:23 AM
Hi Everyone, I have a requirement to implement a search query where I have 3 unique values and one common value 3 unique values-> A, B, C 1 Common Value-> D I am doing something like (A and D) OR (B and D) OR (C and D)  but it is not giving any search result but it should give as  (C and D ) is true. @gcusello if is  possible can you help? ... View more
Labels

Re: How to combine Eventtype Search and lookup da...

by in Splunk Search
‎08-08-2023 03:18 AM
‎08-08-2023 03:18 AM
Hi @gcusello  Thanks for the solution I used join too it is working  ... View more

How to combine Eventtype Search and lookup data i...

by in Splunk Search
‎08-06-2023 08:20 PM
‎08-06-2023 08:20 PM
Hi Everyone, I have an search query and a lookup. Search query gives some filenames and their time of creation and in my lookup which is from external team contains the same filename and transfer time of that file in our system. First search works on eventtype-> Filename and Time of creation are the table fields Second lookup data fields-> Filename and Transfer time I want to combine the data of eventype search and lookup and display into one single table with combined fields like  TIme of creation Filename Transfer Time  How to achieve this I am pretty stuck on this issue ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎08-09-2023 07:29 AM
Karma given to
View All