Splunk Search

search query filter

ringbbg
Engager

I have a simple search query to look for vpn alerts

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="*karachi*" KMD_PM_SA_ESTABLISHED OR "IKE negotiation failed with error"

However, I want to make splunk return results of KMD_PM_SA_ESTABLISHED only when the IKE negotiation failed with error is detected beforehand. Is there a way to do it?

Thanks

Tags (1)
0 Karma

woodcock
Esteemed Legend

Are these 2 conditions contained in the same event or 2 different events?

0 Karma

inventsekar
SplunkTrust
SplunkTrust
>  I want to make splunk return results
> of KMD_PM_SA_ESTABLISHED only when the
> IKE negotiation failed with error is
> detected beforehand

KMD_PM_SA_ESTABLISHED
and
"IKE negotiation failed with error" ---- these two are appearing on a single event or different events?
as you say "only when the IKE negotiation failed with error is detected beforehand", mostly they would be appearing on the same event. so, simply you can use "AND" instead of the the "OR"

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="karachi" KMD_PM_SA_ESTABLISHED AND "IKE negotiation failed with error"

AND is always implied on the search by default (for example - search for "one two" means, its actually searching for "one AND two")

index=nm host = inyod1-jvpn1a-dmz8-lo0 syslog_message="karachi" KMD_PM_SA_ESTABLISHED "IKE negotiation failed with error"
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

niketn
Legend

Change OR to AND, which will match both conditions to be true. Even if you take out OR, by default Splunk will use AND.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...