Splunk Search

search query filter

ringbbg
Engager

I have a simple search query to look for vpn alerts

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="*karachi*" KMD_PM_SA_ESTABLISHED OR "IKE negotiation failed with error"

However, I want to make splunk return results of KMD_PM_SA_ESTABLISHED only when the IKE negotiation failed with error is detected beforehand. Is there a way to do it?

Thanks

Tags (1)
0 Karma

woodcock
Esteemed Legend

Are these 2 conditions contained in the same event or 2 different events?

0 Karma

inventsekar
SplunkTrust
SplunkTrust
>  I want to make splunk return results
> of KMD_PM_SA_ESTABLISHED only when the
> IKE negotiation failed with error is
> detected beforehand

KMD_PM_SA_ESTABLISHED
and
"IKE negotiation failed with error" ---- these two are appearing on a single event or different events?
as you say "only when the IKE negotiation failed with error is detected beforehand", mostly they would be appearing on the same event. so, simply you can use "AND" instead of the the "OR"

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="karachi" KMD_PM_SA_ESTABLISHED AND "IKE negotiation failed with error"

AND is always implied on the search by default (for example - search for "one two" means, its actually searching for "one AND two")

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="karachi" KMD_PM_SA_ESTABLISHED "IKE negotiation failed with error"
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

niketn
Legend

Change OR to AND, which will match both conditions to be true. Even if you take out OR, by default Splunk will use AND.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...