Splunk Search

AND OR Boolean Operators

MeMilo09
Path Finder

Hello,

 

I have a small dilema around AND OR boolean operators. I dont want null time logs for event=timeOut, but at the same time I also want the null values for event=timeOut because I need that info too. Would like to know if using OR instead of AND in the where clause would do that for me?

 

index="mvp.sl.idx"

| eval DeliverToService=case(event="timeOut", logTime)
| eval NullDeliverToService=case(event,"timeOut", logTime)

| stats values(DeliverToService) as  DeliverToService values(NullDeliverToService) as NullDeliverToService

| where isNotNull(DeliverToService) OR isNull(NullDeliverToService)

 

  

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Not entirely clear what you are trying to do here. The case statement in the second eval doesn't look like valid syntax. However, assuming it is supposed to be event="timeout", both DeliverToService and NullDeliverToService will be identical, so if the where clause has an AND instead of OR, you will get no results as the two lists of values generated by the stats command will either both be null or both contain the same values. This doesn't sound like what you are trying to achieve?

View solution in original post

MeMilo09
Path Finder

@ITWhisperer 

Thank you, I only keep one eval and what I will do is also just keep 1 where clause, so I will do the below. In doing so I will exclude the null values too for DeliverToService.  What I was trying to do at first was have seperate columns one for null values and one for isNotNull values - but I was just getting the same data for both columns. 

index="mvp.sl.idx"

| eval DeliverToService=case(event="timeOut", logTime)

| stats values(DeliverToService) as  DeliverToService 

| where isNotNull(DeliverToService) 
 

  

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not entirely clear what you are trying to do here. The case statement in the second eval doesn't look like valid syntax. However, assuming it is supposed to be event="timeout", both DeliverToService and NullDeliverToService will be identical, so if the where clause has an AND instead of OR, you will get no results as the two lists of values generated by the stats command will either both be null or both contain the same values. This doesn't sound like what you are trying to achieve?

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...