title: Splunk: How to filter Source and Destination IP Addresses in firewall log
body: <p>Let say I have the following:</p>
  
  <p>Source IP Addresses, <code>10.1.1.1</code> &amp; <code>192.168.1.1</code></p>
  
  <p>Destination IP Address <code>172.16.1.1</code></p>
  
  <p>What is the right syntax to search for firewall log for this combination?</p>
  
  <p>Is this the right syntax? I tried it but did not get the result. I've also tried different combination but didn't work too.</p>
  
  <blockquote>
    <p>index=firewall src_ip=10.1.1.1 or src_ip=192.168.1.1 and
    dest_ip=172.16.1.1</p>
  </blockquote>