How to properly use OR and WHERE in splunk (2024)

There were some great sessions at .conf2017 that could help you learn some basic SPL
http://conf.splunk.com/sessions/2017-sessions.html
One I'd recommend is Power of SPL, the recording isn't up but the slides are.
there is also this doc that can help you understand a bit of the linguistics
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/UnderstandingSPLsyntax

To get to your question, however.
in host = x OR host = y you will retrieve data from both y and x hosts.
you can also use OR in eval statements, such as |eval newhost=if(host = x OR host = y,"xy",host) would create a field called newhost with values xy when the host is either x or y, otherwise the value would be any other host value.
OR can also be used in where and search statements.

to elaborate, i'll answer your second part:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Where?r=searchtip
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Search
where can be used to eliminate fields that don't match certain criteria, as can the search command.
The difference between where and search, in my opinion, is that search is best for field to value comparisons and where is better for field to field comparisons (or evaluating a field and comparing it to a value). you can see examples in the links I supplied.

the SQL where and the SPL where/search generally do the same thing, the only difference should be the syntax.

How to properly use OR and WHERE in splunk (2024)

References

Top Articles
Latest Posts
Article information

Author: Rueben Jacobs

Last Updated:

Views: 5732

Rating: 4.7 / 5 (77 voted)

Reviews: 84% of readers found this page helpful

Author information

Name: Rueben Jacobs

Birthday: 1999-03-14

Address: 951 Caterina Walk, Schambergerside, CA 67667-0896

Phone: +6881806848632

Job: Internal Education Planner

Hobby: Candle making, Cabaret, Poi, Gambling, Rock climbing, Wood carving, Computer programming

Introduction: My name is Rueben Jacobs, I am a cooperative, beautiful, kind, comfortable, glamorous, open, magnificent person who loves writing and wants to share my knowledge and understanding with you.