Splunk Search

## OR conditional combination show less events

Path Finder

Hi Guys! It's me again!
A few days ago i was asking how can i eval some fields and get the total from them. Now i want to show those in a table format and for that, i made this search:

``````index=MY_INDEX (FIRST_ACT=5 AND SECOND_ACT=2) OR (FIRST_ACT=5 and SECOND_ACT=4 and STAT_FLAG=0) OR (FIRST_ACT=5 and SECOND_ACT=4 and STAT_FLAG=4).
``````

This search returns 10 events, but, in fact, there 14 events. How i know that? Because i have another panel that show's me the same events, but with and eval expression and a Single Value accumulation:

``````MySearch | eval UTCOD=if((FIRST_ACT=5 and SECOND_ACT=2), 1, 0) | eval UTCOQ=if((FIRST_ACT=5) and (SECOND_ACT=4) and (STAT_FLAG=0), 1, 0) | eval UTSQ=if((FIRST_ACT=5) and (SECOND_ACT=4) and (STAT_FLAG=4), 1, 0) |  eval all_UT=UTCOD+UTCOQ+UTSQ | status sum(all_UT) as total
``````

So ...why is that? Why when i search with OR conditional the result is 10, but when the search is made with EVAL founds 14 events?

Thanks a lot for help.

Tags (3)
1 Solution
SplunkTrust

I think the order in which each expression is evaluated may be affecting the results. Try this.

``````index=MY_INDEX ((FIRST_ACT=5 AND SECOND_ACT=2) OR (FIRST_ACT=5 AND SECOND_ACT=4 AND STAT_FLAG=0) OR (FIRST_ACT=5 AND SECOND_ACT=4 AND STAT_FLAG=4))
``````
---
If this reply helps you, Karma would be appreciated.
SplunkTrust

I think the order in which each expression is evaluated may be affecting the results. Try this.

``````index=MY_INDEX ((FIRST_ACT=5 AND SECOND_ACT=2) OR (FIRST_ACT=5 AND SECOND_ACT=4 AND STAT_FLAG=0) OR (FIRST_ACT=5 AND SECOND_ACT=4 AND STAT_FLAG=4))
``````
---
If this reply helps you, Karma would be appreciated.
Path Finder

OMG!...i feel so noob... All i need was a couple "()" to group all the conditional expression... And i swear that try with that, but surely in the wrong way.

Thanks a lot RichGalloway! Happy New Year from Argentina!

Get Updates on the Splunk Community!

#### The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

#### Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

#### Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...