where field 1 or field 2 equals False

[hastrike]

I have two fields in a query where they either equal True or False and I want to find all the results where these two fields equal False. I have tried | where field1 ="False" OR field2 ="False"

However, when I run this it only picks up the first field it doesn't pick up the 2nd Field? Both fields should not be false at the same time. I have also tried the search command as well instead of where.

[somesoni2]

From your 2nd para, it looks like you need this. This will ensure at least one of them is false and both are NOT true and both are not false.

| where field1!=field2

[hastrike]

Sorry that must have been confusing. I want the results where both answers are false.

[somesoni2]

In that case @javiergn's answer is what you're looking for. No result doesn't necessarily mean it didn't work, your data could be like that. Can you check manually to see if there really is a data satisfying your condition?

[javiergn]

You need a logical AND in this case:

| where field1 ="False" AND field2 ="False"

The OR you are using will return any event where either field1 is False or field2 is false, or both, or one of them is true and the other false.

Note you can use search too:

| search field1 ="False" AND field2 ="False"

[hastrike]

I tried this and I keep getting no results found. However, it works if I use a single field or use OR instead of AND. Just need results when either are False.

[javiergn]

Hi, I'm reading your question again and your 1st paragraph contradicts your second one.

In summary:

Both fields are false at the same time:

| where field1 ="False" AND field2 ="False"

One of them is false and the other true:

| where field1 != field2

One of them is false and the other don't care:

| where field1 ="False"

| where field2 ="False"