Splunk Search

Searching for multiple strings

jxjackso
Explorer

I'm trying to collect all the log info for one website into one query. The site uses two starting url's /dmanager and /frkcurrent. I'm trying to figure out a query that will give me both the dmanager and frkcurrent records

I tried: sourcetype=access_combined frkcurrent *dmanager* but I don't get any results. I know I'm doing something wrong, but I'm not sure what. I looked through the search manual, but didn't see anything that stood out as an obvious answer.

Thanks

0 Karma
1 Solution

ftk
Motivator

You need to use OR logic in your query as such:

sourcetype=access_combined (frkcurrent OR dmanager)

Check out the this part of the documentation for a more in depth coverage of the search language.

View solution in original post

jxjackso
Explorer

Gah, I tied or, but didn't capitalize it.

0 Karma

ftk
Motivator

You need to use OR logic in your query as such:

sourcetype=access_combined (frkcurrent OR dmanager)

Check out the this part of the documentation for a more in depth coverage of the search language.

stanwin
Contributor

If I have large number of nested OR conditions..

e.g. there are 40 error codes that I need to search through in logs to show only relevant events in timechart..

what would be better option?

  multiple OR conditions  (1 OR 2  OR 3 ... OR 40 )
 configure a  lookup

In terms of tidiness or adding new codes, lookup is better definetely.

However there will be no increase in the error code list ever..

So in terms of performance is the OR Clause or lookup preferred approach?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

@stanwin i'd suggest asking a new question and deleting this comment - this question has already been answered and might not get very much attention

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...