Splunk online course

Using Boolean Expressions in Splunk Searches

Learn how to use AND, OR, and NOT in Splunk searches to require conditions, match alternatives, exclude noise, and group field-based filters.

A Boolean expression combines search conditions with logical operators. In Splunk, Boolean logic helps you control which events are returned by the base search: the initial search that locates events before later pipeline commands process them.

Use Boolean expressions to answer three basic questions:

• What must be true? Use AND, either explicitly or implicitly.
• What alternatives are acceptable? Use OR.
• What must not be present? Use NOT.

For example, a search can require a server error, accept either of two HTTP methods, and exclude a noisy host. Clear grouping makes the intended rule visible and reduces unexpected results.

Boolean operators at a glance

Using AND to require conditions

AND means that every connected term or condition must match the same event. It is useful when narrowing a search to events that satisfy several requirements.

Explicit and implicit AND

In standard Splunk search syntax, adjacent search terms separated by spaces are treated as an implicit AND:

GET failed

This returns events that contain both GET and failed. The explicit form states the relationship directly:

GET AND failed

These searches express the same basic requirement. Use the space-separated form for simple searches, and use explicit AND when it improves readability inside a more complex expression.

AND with field-value conditions

A field-value condition restricts a search using an extracted field, such as status=404 or host=web01. Field conditions can be combined with free-text terms:

sourcetype=access_combined failed

This requires the event to have the specified source type and to match the word failed. An explicit equivalent is:

sourcetype=access_combined AND failed

You can require several field conditions as well:

host=web01 AND method=GET AND status=404

Every condition must qualify the event for it to be returned.

Using OR to match alternatives

OR broadens a search. An event is returned when at least one alternative matches. Events matching both alternatives also qualify.

Use OR for synonymous messages, multiple HTTP methods, status values, or possible sources:

timeout OR timed_out

method=GET OR method=POST

status=404 OR status=410

source=web01.log OR source=web02.log

When an alternative group is combined with another required condition, put the alternatives in parentheses:

(GET OR POST) failed

This means: match an event containing either GET or POST, and also require failed.

Without grouping, a multi-operator search can be interpreted differently from the rule you intended. Parentheses make the relationship explicit and help prevent an OR alternative from effectively bypassing another condition.

Using NOT to exclude events

NOT removes events that match the following term or condition. It is useful after you have identified the relevant event family and want to filter out known noise.

For example:

GET NOT cart

This searches for GET-related events except events that also contain cart.

You can exclude a field value:

status>=500 NOT host=dev-web01

This returns qualifying server-error events that do not originate from dev-web01. Exclusions can target a source, URI, action, method, or status:

status>=500 NOT source=health-check.log

Be careful with broad exclusions. If a term appears in useful events as well as noisy events, NOT can remove more than intended. Inspect excluded examples and prefer a specific field condition or phrase when possible.

Grouping conditions with parentheses

Parentheses define a group of conditions that should be evaluated together. They are especially important when combining OR with required conditions or exclusions.

Combine an OR group with a required term

(GET OR POST) failed

The grouped expression means:

• The event contains GET or POST.
• The event also contains failed.

Another common example uses fields:

sourcetype=access_combined (method=GET OR method=POST)

This requires the access_combined source type and allows either request method.

Exclude a grouped condition

status>=500 NOT (uri_path="/health" OR uri_path="/metrics")

This means: return server-error events, except events whose URI path is either /health or /metrics.

Parenthesized groups take precedence over surrounding expressions. In multi-operator searches, use parentheses even when you think the interpretation is obvious. They document the rule for other users and protect the search when it is later expanded.

Grouped versus ungrouped Boolean searches

Evaluation order and plain-language interpretation

Precedence is the order in which parts of an expression are evaluated. Parenthesized groups take precedence over the surrounding expression. Rather than relying on a reader or on an assumed order in a complex search, group every alternative or exclusion that belongs together.

Before running a multi-operator search, translate it into plain language. For example:

sourcetype=access_combined (method=GET OR method=POST) NOT status=404

Translate it as: “Find access events where the method is GET or POST, and exclude events with status 404.” This makes it easier to notice whether the search actually expresses the investigation rule.

Boolean logic with fields

Boolean operators work with fields such as status, sourcetype, host, source, action, and method. A field comparison may use equality or a comparison operator:

status=404 OR status=500

action=blocked AND method=POST

status>=500 AND sourcetype=access_combined

Fields can be combined with unstructured keywords:

host=web01 (timeout OR failed) NOT action=healthcheck

Here, the host is required, either keyword can match, and events with the excluded action are removed.

Quote a field value when it contains spaces or special text that should be treated as one phrase:

message="connection reset by peer"

Verify that the field is actually extracted and that the field name and value are correct. A Boolean expression cannot match a field condition reliably when the field is absent or incorrectly named.

Common Boolean search patterns

A practical search-construction workflow

1. Start with one known term or field restriction. For example, begin with status>=500 or a keyword known to occur in the target events.
2. Add required conditions. Use spaces for implicit AND or write AND explicitly when the relationship needs emphasis.
3. Add alternatives inside parentheses. Use an OR group for multiple methods, values, messages, or sources.
4. Add NOT clauses last. First confirm that the base search finds the intended event family, then remove known noise.
5. Review the results. Check sample events, fields, result count, and the timeline after each meaningful change.
6. Test exclusions. Temporarily remove the NOT clause or inspect matching field values to verify that useful events were not removed.

For an introduction to field extraction and field-value syntax, see Splunk fields. You can also review Splunk search rules before building a saved search, report, or alert.

Troubleshooting Boolean searches

An operator is searched as ordinary text

Symptom: Adding an operator word does not change the logic.

Likely cause: The word was entered in lowercase or mixed case.

Resolution: Use uppercase AND, OR, and NOT consistently.

OR returns too many events

Likely cause: The alternatives were not grouped with the other required conditions.

Resolution: Put the alternatives in parentheses, such as (GET OR POST) failed, and then review sample events.

NOT removes expected results

Likely cause: The excluded word or field condition also occurs in relevant events.

Resolution: Inspect the removed events. Narrow the exclusion with a field restriction or use a more specific quoted phrase or value.

Two space-separated terms do not behave as alternatives

Likely cause: Space-separated terms are an implicit AND, so both are required.

Resolution: Use OR when either term should qualify an event, for example timeout OR failed.

A field-based expression behaves unexpectedly

Likely causes: The field is not extracted, the field name or value is wrong, or a multiword value was not quoted.

Resolution: Confirm the field in the event details or fields sidebar, verify spelling and values, and quote values such as message="connection reset by peer".

Exam-relevant notes

• AND requires all connected conditions; adjacent terms normally provide an implicit AND.
• OR matches at least one alternative and can broaden results.
• NOT excludes events matching the following term or condition.
• Boolean operators must be uppercase.
• Use parentheses to combine an OR group with required conditions or to apply NOT to several alternatives.
• Field-value conditions can be combined with free-text terms and other field conditions.
• Always validate the event results after adding an operator, especially OR and NOT.

Once the base search is accurate, you can pass its results to SPL pipeline commands such as those described in Splunk pipes, or save the search as a report or alert.