Splunk Search

Search for multiple keywords.

ykmohank
New Member

Hi,

I want to do a search having multiple strings.

Example: Consider,I am looking for SearchKey1 and SerachKey2

In SQL i will write something like this

Select * from Table_Name where ColumnName like '%SearchKey1%' and ColumnName like '%SerachKey2%'

IN SQL the above query returns me all the rows having both search keys SearchKey1 and SearchKey2 in it.

I want to achieve similiar kind of search in SPLUNK. Please help me with appropriate code.

Tags (3)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ykmohank,

as always docs is your friend, read this guide for SQL users.

cheers, MuS

MuS
SplunkTrust
SplunkTrust

but I give you some hint:

source=_Name ColumnName="*SearchKey1*" ColumnName="*SearchKey2*"
or
index=_Name ColumnName="*SearchKey1*" ColumnName="*SearchKey2*"

adminpulse
Loves-to-Learn Lots

its not working

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...