Query help for WIDGET

[guy]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
Not really a problem. I’ve been ask to make a report of VPN connections In and out. Which I have been able to make using two Dashboard Widgets.

gl2_source_input:587*************** AND source:“C*****:” AND message:“went offline” AND message:“name”

gl2_source_input:587***************************** AND source:“c*****” AND message:“assigning virtual IP” AND message:“name”

Which is great but I have to run the two separately. How would I add/join them to be one query? Plus add extra names to it. So would look at “name” “name1” thanks.

2. Describe your environment:

• OS Information:

• Package Version:

• Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?

Looking at AND and JOIN and pages of query text.

4. How can the community help?

Help a person that has no real idea about this query language

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

[tmacgbay]

You can put parenthesis around the two queries with an OR in between to get it to find both:

(gl2_source_input:587*************** AND source:"C*****:" AND message:"went offline" AND message:"name") OR (gl2_source_input:587***************************** AND source:"c*****" AND message:"assigning virtual IP" AND message:"name")

You can rearrange the query and separate out the name to be ((stuff) OR (other stuff) ) AND (message:name OR message:name1)

NOTE: used the forum tool </> to make formatting for code a little nicer to read.

Alternatively if you have the Operations (Enterprise) license, you can facilitate the names with parameters.

The Operations (Enterprise) license is free if you can keep your data below 2GB daily.