Splunk Search

What is the order that executes in query when I use both AND, OR in splunk query?

pavanae
Builder

I have two different queries like below

Query 1 :-

field_1!="A" AND field_2="B" OR field_1!="A" AND field_2="C" OR field_1!="A" AND field_2="D" OR field_1!="A" AND field_2="E"  

Query 2 :-

field_1!="A" AND (field_2="B" OR field_2="C" OR field_2="D" OR field_2="E" )

In my view both the queries should give the same result but it's giving me the different result. What's the difference between both the queries and what's the actual order splunk executes?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Your query 1 is hochpoch because of no clear distinction of the grouping of AND conditions and due to order in which the logical operators are executed (see here) they're not doing what you want to do, which is query 2. Below two query should give you same result.

Reformatted query 1:

(field_1!="A" AND field_2="B") OR (field_1!="A" AND field_2="C") OR (field_1!="A" AND field_2="D") OR (field_1!="A" AND field_2="E" ) 

Query 2 :-

 field_1!="A" AND (field_2="B" OR field_2="C" OR field_2="D" OR field_2="E" )

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Your query 1 is hochpoch because of no clear distinction of the grouping of AND conditions and due to order in which the logical operators are executed (see here) they're not doing what you want to do, which is query 2. Below two query should give you same result.

Reformatted query 1:

(field_1!="A" AND field_2="B") OR (field_1!="A" AND field_2="C") OR (field_1!="A" AND field_2="D") OR (field_1!="A" AND field_2="E" ) 

Query 2 :-

 field_1!="A" AND (field_2="B" OR field_2="C" OR field_2="D" OR field_2="E" )
0 Karma

pavanae
Builder

Cool thanks @somesoni2. That makes sense now. PLease post the same as a answer. I am going to accept that. Thanks again.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...