I'm needing to use multiple AND's and OR's in my where clause and the way I'm writing it is giving me inconsistent results.
The data I'm searching is sendmail logs and I'm getting the "from" and "to" fields for emails. The results I need are where the emails are sent from the domains @example1.com or @example2.com and the recipient is NOT in the domain @foobar1.com or @foobar2.com.
How I though it would go is like this, where the first 2 are grouped together then the second 2 are grouped together... like sql:
sourcetype=mail_log | transaction qid | where (like(from, "%@example1.com") OR like(from, "%@example2.com")) AND (like(to, "%@foobar1.com") OR like(to, "%@foobar2.com"))
This returns a "search job has failed" error.
I also tried to just pipe it to another where clause like this:
sourcetype=mail_log | transaction qid | where like(from, "%@example1.com") OR like(from, "%@example2.com") | where like(to, "%@foobar1.com") OR like(to, "%@foobar2.com")
But this gave me inconsistent results.
What is the proper way to write this out?
... View more