Splunk Search

OR operator problem

bugnet
Path Finder

Hi all,

Hey, what's wrong with the next search structure?
I'm using OR operator because the field names are different in each index.

(index=fw product=barracuda severity>=5 geo!=Greece)
OR (index=apache msg!=error )
OR (index=nac Name!="pass" Name!="manage" Name!="error")
AND src_ip!=10.0.0.0/8 src_ip!=172.16.0.0/12 src_ip!=192.168.0.0/16

Thanks

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Item 1 - Computer Science 101: mixing ORs and ANDs without specifying order of operation.

Assuming it's what you mean, try:

((index=fw product=barracuda severity>=5 geo!=Greece)
OR (index=apache msg!=error )
OR (index=nac Name!="pass" Name!="manage" Name!="error"))
AND ( rc_ip!=10.0.0.0/8 AND  src_ip!=172.16.0.0/12 AND src_ip!=192.168.0.0/16)

Item 2 - IP specification

For the second phrase, you probably mean...

AND NOT
((src_ip>=10.0.0.0 AND  src_ip<=10.0.0.8 ) OR 
 (src_ip>=172.16.0.0 AND  src_ip<=172.16.0.12 ) OR 
 (src_ip>=192.168.0.0 AND  src_ip<=192.168.0.16 ) )

...except that's not right either, since it's lexicographical comparison, but you get the idea.

Myself, I'd probably break that out into a separate search or regex, as the first verb after the initial search, which might look something like this...

| regex rc_ip!="^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$"

or

| search NOT match(rc_ip,"^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$")

or

| where NOT match(rc_ip,"^10\.0\.0\.[0-8]|172\.16\.0\.([2-90]|1[0-2]?)|192\.168\.0\.([2-90]|1[0-6]?)$")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What makes you think something is wrong?

There is a missing '=' before "manage", but I assume that's in the question and not in the query.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...