Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Search for either of two values, given only one value

$
0
0
I'm trying to lookup all lines that have EITHER a Matching Name or Phone, when given ONLY the Name to search for. And I Know the "Combiner" entry will Always exist, and have both. EntryTag,Name,Phone Alpha,Wilma_Flintstone, Bravo,Wilma_Flintstone, Charlie,Wilma_Flintstone, Combiner,Wilma_Flintstone,555-1212 Delta,,555-1212 Echo,,555-1212 Fox,Wilma_Flintstone,555-1212 Assume there are thousands of other lines with different Names and different Phones. source="SecondarySearch.csv" returns everything. (All Seven Entries. Alpha,Bravo,Charlie,Combiner,Delta,Echo,Fox) source="SecondarySearch.csv" EntryTag=Combiner Name=Wilma_Flintstone Phone=* | return 1 iName=Name,iPhone=Phone Returns . . . iName="Wilma_Flintstone" iPhone="555-1212" So, I was hoping to take that successful search (for a line that I know will contain BOTH the Name and Phone and will always exist) and make it a subsearch, where the Human would enter ONLY the $Name$ Name, "I" within the subsearch would lookup the matching Phone # (from the Combiner EntryTag line that will always exist), then perform an outer search for Name=Wilma_Flintstone OR Phone=555-1212, like . . . source="SecondarySearch.csv" Name=iName OR Phone=iPhone [search source="SecondarySearch.csv" EntryTag=Combiner Name=Wilma_Flintstone Phone=* | return 1 iName=Name,iPhone=Phone] No error, but no results either. OK, lets try WHERE on the end, instead of Field=Field on the front. source="SecondarySearch.csv" [search source="SecondarySearch.csv" EntryTag=Combiner Name=Wilma_Flintstone Phone=* | return 1 iName=Name,iPhone=Phone] | WHERE Name=iName OR Phone=iPhone Again, no error, but no results either. I KNOW the subsearch by itself finds the Combiner line and returns Wilma_Flintstone and 555-1212 both. I just can't then figure out how to use those two found values to search for ALL the lines that have EITHER the matching Name or Phone#.

Viewing all articles
Browse latest Browse all 47296

Trending Articles