Getting Data In

How to search for multiple fields in a source files?

npestana88
New Member

So I have a set of source files that list different fields as separate events and I would like to search for source files that have the specified field values. However when I search for multiple fields (eg. diameter=30 AND temp=77) it doesn't return any results since the fields are contained in different events. Is there a way around it? All I need are the names of the source files.
Sorry if this is an obvious question, I'm still new at this

0 Karma

hcbomb
Path Finder

To paraphrase, it sounds like you're trying to search for particular events to generate a list of sources. From this curated list, search for a different type of events, right?

If so, make yourself familiar with sub-searches:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

Also, what precisely are you trying to look for that should belong to the first group of sources vs. what should be found from the other?

Your structure would basically look like this:

Subsearch query for the events:

source= diameter=X

Filter this to specifically the sources:

source= diameter=X | fields
source

Insert into a different search, which includes the other field:

( [search source= diameter=X
| fields source ]) temp=Y

Now you have all events that fit temp=Y but only if that source has events that match diameter=X. Let me know if that works!

0 Karma

stephanefotso
Motivator

Hello! Try.

.....source=firstsourcefile OR source=secondsourcefile (diameter=30 AND temp=77)|......
SGF
0 Karma

npestana88
New Member

Hi thanks for the response, what I'm trying to do is look through a lot of source files so I can't exactly type in all of the names of the file, it there a way to scan all source files in the index?

0 Karma

stephanefotso
Motivator

ok let suppose that your souce name is mysource/poooo/jjjjjjj/yyyyyyy/............./ or yyyyyyyyyy/second/........

you can use the star(*) symbol to match any caracter in your source field. Something like this

source=mysource* OR source=*second* (diameter=30 AND temp=77)|...
SGF
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...