Splunk Search

How to edit my search to return events where Field2 has both values 'foo' AND 'bar' in multivalue Field1?

jwalzerpitt
Influencer

I have events in which Field1 contains multiple values, but I only need to look for two values (foo AND bar) and tie them to Field2. What's the most efficient way to craft this search?

I'm basically looking for events to be returned in which Field2 has both 'foo' AND 'bar' in Field1.

Thx

0 Karma

jplumsdaine22
Influencer

I'm guessing that field1 in its original context is not a multivalue field. So what you need is an additional search command after your stats command.

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) by Field2 | search (Field1=foo AND Field1=bar)
0 Karma

jwalzerpitt
Influencer

I've been running the following query below and I believe I'm getting the results I need. Would be interested to see if someone could runt he same query and check if they're getting the results they'd expect as well.

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) as Total by Field2 | where Total >=2

Thx

0 Karma

jwalzerpitt
Influencer

And i just realized one flaw in my logic in that Field1 will always be an 'OR' as the even though Field2 can have one of the two Field1 values, it will be one value per event. Field2 will never have 'foo' and 'bar' in the same event.

0 Karma

jwalzerpitt
Influencer

Thx for the reply - actually Field1 is the multivalue field (it has seven total values, but I'm only looking to pull two)

0 Karma

jwalzerpitt
Influencer

I do have the following query:

index=indexname Field1=foo OR Field1=bar | stats values(Field1), dc(Field1) by Field2

But if I change the 'OR' to 'AND' it kills the query

Thx

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...