Splunk Search

AND Condition to find the keywords in logs

abhishekgandhe
Explorer

I have log. I want to find all 4 keywords. It should be AND condition and not OR.
Critical Lab
Lab
Critical Process
Process
If any one of them is not present then fail. If all 4 present then pass.
How to do it in Regex.

Tags (1)

ddrillic
Ultra Champion

"Critical Lab" AND "Critical Process" AND Process should do it...

0 Karma

abhishekgandhe
Explorer

I have written REGEX for this. Is this the correct one.

index="cpsprod" sourcetype="mscs:storage:blob:cps-qa-rc-calc" (Critical-Lab AND \"LAB AND Critical-Process AND \"Process)

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

If you find "Critical Lab" in an event does that also mean "Lab" has also been found?

0 Karma

493669
Super Champion

Can you please share some sample logs(with masking sensitive data) to create regex expression

0 Karma

abhishekgandhe
Explorer

"Critical-Lab checkRcReady for batchId ==>9a508f01-4e93-4d76-9a9d-fe1cf8bd0550==true :: Output Quality 0.0%"

0 Karma

pramit46
Contributor

First of all, you don't need to check all four, since 1st and 3rd also cover for 2nd and 4th.

Secondly, your sample does not tell us where the word(s) 'Critical Process' will occur. I doubt if people will be able to help you without a proper sample.

Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...