Sadly I don't think there is anything that allows you to specify a wildcard in the name of the field, so you'll have to specify your fields individually: | search field1="true" OR field2="true" OR field3="true" In your particular case you have the added problem that your fields have special characters, so I suggest running a rename first to wipe out the special characters: | rename multiyearfield*(*) as multiyearfield_*_* your final answer would look something like this: <base search> | rename multiyearfield*(*) as multiyearfield_*_* | search multiyearfield_18_9 = "true" OR multiyearfield_19_3 = "true" OR multiyearfield_20_87 = "true" Here's what I did to test it - only ID 1 and 3 get returned in the below: | makeresults 1 | eval multiyearfield19(3) = "false", multiyearfield18(9) = "true", multiyearfield20(87) = "false", ID = 1 | append [| makeresults 1 | eval multiyearfield19(3) = "false", multiyearfield18(9) = "false", multiyearfield20(87) = "false", ID = 2] | append [| makeresults 1 | eval multiyearfield19(3) = "true", multiyearfield18(9) = "true", multiyearfield20(87) = "true", ID = 3] | rename multiyearfield*(*) as multiyearfield_*_* | search multiyearfield_18_9 = "true" OR multiyearfield_19_3 = "true" OR multiyearfield_20_87 = "true" Here's a very cool answer to a very similar question. The person who answers the question uses a subsearch to build the "OR statement" for them. Since they had multiple fields AND multiple values they were looking through: https://answers.splunk.com/answers/269855/searching-a-number-of-fields-with-the-same-keyword.html Hope this helps --- EDIT: answering the further question of doing the field list dynamically --- Alright - so expanding on what the link I provided does here's a solution that should work dynamically. I'll break it down: Create a list of the fields that match multiyear*: | rename multiyearfield*() as multiyearfield__* | fieldsummary | search field=multiyear* | table field Step 1 is used as the "fields" part of the answer from the link for the subsearch: ... | eval values = "true" | makemv values | mvexpand values | eval {field} = values | fields - field values put this into your base search and you should get a dynamic answer without hardcoding your fields | rename multiyearfield*() as multiyearfield_* | search [ | rename multiyearfield*(*) as multiyearfield _ | fieldsummary | search field=multiyear* | table field | eval values = "true" | makemv values | mvexpand values | eval {field} = values | fields - field values] Code used for testing: | makeresults 1 | eval multiyearfield19(3) = "false", multiyearfield18(9) = "true", multiyearfield20(87) = "false", ID = 1 | append [| makeresults 1 | eval multiyearfield19(3) = "false", multiyearfield18(9) = "false", multiyearfield20(87) = "false", ID = 2] | append [| makeresults 1 | eval multiyearfield19(3) = "true", multiyearfield18(9) = "true", multiyearfield20(87) = "true", ID = 3] | rename multiyearfield*(*) as multiyearfield_*_* | search [| makeresults 1 | eval multiyearfield19(3) = "false", multiyearfield18(9) = "true", multiyearfield20(87) = "false", ID = 1 | append [| makeresults 1 | eval multiyearfield19(3) = "false", multiyearfield18(9) = "false", multiyearfield20(87) = "false", ID = 2] | append [| makeresults 1 | eval multiyearfield19(3) = "true", multiyearfield18(9) = "true", multiyearfield20(87) = "true", ID = 3] | rename multiyearfield*(*) as multiyearfield_*_* | fieldsummary | search field=multiyear* | table field | eval values = "true" | makemv values | mvexpand values | eval {field} = values | fields - field values] ... View more

<your base search> | eval from = if(cmd=="env_from",value,null()) | eval to = if(cmd=="env_rcpt",value,null()) | stats values(from) as From values(to) as To by s This assumes that the FROM field will always have "env_from" value under the CMD field, and the TO field will always have "env_rcpt" in the CMD field. Hope this helps ... View more

Alright this should do it: <your_base_search> | stats values(Status) as statuses by Test_ID | where isnull(mvfind(statuses,"Failed")) | stats count Explanation: | stats values(Status) as statuses by Test_ID - creates a multivalue field named "statuses" which contains all the possible values of Status for each Test_ID | where isnull(mvfind(statuses,"Failed")) - excludes any results of the multivalue field statuses that contain a value = to "Failed" - note this uses REGEX so it's case sensitive | stats count - counts the number of results that passed the where clause Hope this helps What I ran to test: | makeresults 1 | eval Test_ID=123, Test_Name="Test1", Status="Passed" | append [| makeresults 1 | eval Test_ID=123, Test_Name="Test2", Status="Passed"] | append [| makeresults 1 | eval Test_ID=123, Test_Name="Test3", Status="Failed"] | append [| makeresults 1 | eval Test_ID=123, Test_Name="Test4", Status="Passed"] | append [| makeresults 1 | eval Test_ID=345, Test_Name="Test1", Status="Failed"] | append [| makeresults 1 | eval Test_ID=345, Test_Name="Test2", Status="Passed"] | append [| makeresults 1 | eval Test_ID=567, Test_Name="Test1", Status="Passed"] | append [| makeresults 1 | eval Test_ID=567, Test_Name="Test2", Status="Passed"] | append [| makeresults 1 | eval Test_ID=567, Test_Name="Test3", Status="Passed"] | stats values(Status) as statuses by Test_ID | where isnull(mvfind(statuses,"Failed")) ... View more

@lucasdc can you provide a sample of 3-5 values that are incorrectly showing up in the results, and can you provide a brief explanation as to why you think they shouldn't be showing up? ... View more

What you are looking for is | stats values(vip) as VIPs values(snps) as SNPS rather than dc() . This will give you the full list of distinct values in those fields as an multivalue field. Read here for more info. Hope this helps ... View more

You are likely running a join or something similar. All the limits are configured under limits.conf. Be very careful about changing them though because they can have a big impact on performance! There are ways of doing joins without the "join" command. I suggest you post the search you are trying to perform so that someone can help you build out the more efficient search without the join. Hope this helps ... View more

This should do the trick: Interface (?<src_interface>[^,]+), changed state to (administratively )?(?<port_status>\w+) The '?' after the '(administratively )' capture group, basically tells the regex that the previous group/character is optional. Used this as my sample data: Interface 123, changed state to administratively up Interface 234, changed state to administratively down Interface 321, changed state to up Interface 432, changed state to down It catches all 4 distinct values of "src_interface" and "port_status". I used regex101 to help double check the regex. Hope this helps ... View more

These look like winEventLog:Security. You should look into using the Splunk TA for windows and the out of the box sourcetypes that come with it to handle this type of data. Then your extractions will work automatically rather than having to write your own. In terms of running an inline regex what @jkat54 said is correct, just run your base search followed by ... | regex "(?ms)Target Account:.*Security ID:.*Account Name:\s+jsmith" ... View more

Did not know about this | stats range(_time) AS duration BY number . TIL something ... View more

In your base search add (state="Pending" OR state="Resolved") , then use the transaction command as follows: | transaction <field(s) to group by> startswith="Pending" endswith="Resolved" The transaction command automatically gives you a "duration" field in seconds. Hope this helps ... View more

First thing I'll say is that running PartnerPortal is very different from running connectionid = PartnerPortal , which in turn is different from running connectionid = PartnerPortal* in your base search. For example if you have these three events: event 1 = time1 there was an error in PartnerPortal. adapterid=value1.a subject=value2.a event 2 = time2 connectionid=PartnerPortal adapterid=value1.b subject=value2.b event 3 = time3 connectionid=PartnerPortalConfig adapterid=value1.c subject=value2.c Running just a string search for "PartnerPortal" in your base search, you'll get all three events above returned. Running connectionid = PartnerPortal* in your base search will return event 2 and event 3 but not event 1, since event 1 doesn't even have the field connectionid in it Running connectionid = PartnerPortal in your base search will return only event 2, since the value of connectionid in event 3 is actually PartnerPortalConfig Hope this helps ... View more

There's a couple of things you can do: 1) At search time you can add the following (assuming it's your host field that contains the fully qualified domain name): <base_search> | rex field=host "^(?P<hostname>[^\.]+)" | eval hostname=lower(hostname) Then you can use the new field "hostname" to do your check against your lookup. 2) Otherwise you can define a "calculated field" to extract the value out of the fully qualified domain name field: lower(mvindex(split(host,"."),0)) This assumes that your FQDN is stored under field 'host', and it will grab everything up to the first period as the value for whatever field you define. Hope this helps ... View more

Modifying time tokens is a little tricky, here's a link to another Splunk answers question that has a working solution to your problem. Hope this helps ... View more

Unfortunately not. ... View more

it's because you can't do -4h of a token. Here's an answer that solved modifying tokens. It's not pretty, but it should get the work done. ... View more

Something like this should do the trick for you: (eventtype=breach earliest=-4h@h latest=now) OR (eventtype=login earliest=-8h@h latest=now) Hope this helps ... View more