Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Splunk query OR condition

$
0
0
Trying to parse the following line: newCount 20 OldCount 10 The following is my splunk query: index="server" | rex "newCount"\s+"(?\w+)" | rex "OldCount"\s+"(?\w+)" | search newcount>0 | search oldcount>0 | timechart span=1h count How can i ensure that irrespective of whether newCount or oldCount is greater than 0, my splunk query will catch that ?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>