Need help on subsearch

I have a log statement that looks list this: ipAddress=1.2.3.4,userId=42,productId=24

Currently I manually first search "ipAddress=" AND "userId=" AND "productId=" to pull out the 3 values. Then I search for the union of these fields: search "ipAddress=1.2.3.4" OR "userId=42" OR "productId=24".

How can I automated this two searches? I tried following the subsearch example but it's not working.

subsearch

asked 08 Nov '10, 17:03

wang
11●3
accept rate: 0%

One Answer:

oldest newest most voted

0	Hi Alice, Have you tried something like this? `* [search ipAddress=123 AND userId=123 AND productId=123 \| fields + ipAddress,userId,productId \| format "(" "(" "OR" ")" "OR" ")"]` link answered 11 Nov '10, 04:06 hulahoop ♦ 2.5k●3●2●40 accept rate: 40%

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

subsearch ×131

Asked: 08 Nov '10, 17:03

Seen: 954 times

Last updated: 01 Apr '11, 08:22

Need help on subsearch

Follow this question

Splunk Resources

Related questions