Issue, here is my search
index=my_index EventSubType="Computer Modified"
NOT UserName="System"
"HostIP=172.16.1." OR
"HostIP=172.16.4." OR
"HostIP=172.16.5.*" OR
| table _time EventSubType UserName HostIP HostName Message
Here is my error - Error in 'search' command: Unable to parse the search: 'OR' operator is missing a clause on the right hand side.
Please help, thank you
Thank you very much for the help. I am able to get the results I need.
You have an extra OR and you should probably have parentheses if I am reading your intentions correctly.
index=my_index EventSubType="Computer Modified"
NOT UserName="System"
("HostIP=172.16.1." OR "HostIP=172.16.4." OR "HostIP=172.16.5.*")
| table _time EventSubType UserName HostIP HostName Message
With the order of processing and implied ANDs your OR's will not work correctly without the parentheses
Very helpful thank you
Not quite, the parentheses there are optional. In SPL operator precedence, these two searches are equivalent:
| makeresults | eval a = "1 2", b = "2 3" | makemv a | mvexpand a | makemv b | mvexpand b | search a=1 b=2 OR b=3
| makeresults | eval a = "1 2", b = "2 3" | makemv a | mvexpand a | makemv b | mvexpand b | search a=1 (b=2 OR b=3)
Apparently I was taught wrong. Thanks for the info.
Remove the third superfluous OR
from your search.
Worked thank you!