topic How do you specify a list in WHERE condition? in Splunk Search

How do you specify a list in WHERE condition?

vaibhavvijay9 — Fri, 08 Feb 2019 07:03:02 GMT

Hi All,

I want to display only results which are present in a given list (please see below) :

....... | xmlkv | stats count by "ApplicationFunction" | WHERE "ApplicationFunction" IN ("Price", "History", "Notify")

There are around 10 values that I want to filter out from 30-40 values. So the list specified in IN will have 10 values.
I want to create an overview dashboard (PieChart).

*Is this possible with Splunk? *

If yes, please help me. Otherwise, please specify any possible way to achieve the same.

Thanks in advance !

Re: How do you specify a list in WHERE condition?

vishaltaneja070 — Fri, 08 Feb 2019 07:10:00 GMT

Hello @vaibhavvijay9

I think the issue is with double quotes if you mention field name in double quotes in where command then it will become a value which is causing issue in your case. Try this:

    ....... | xmlkv | stats count by ApplicationFunction | WHERE ApplicationFunction IN ("Price", "History", "Notify")

Re: How do you specify a list in WHERE condition?

vishaltaneja070 — Fri, 08 Feb 2019 07:12:41 GMT

And also you can create a lookup of ApplicationFunction and try to filter from there as well. Like below
|stats count by ApplicationFunction | search [|inputlookup ApplicationFunction.csv]

Re: How do you specify a list in WHERE condition?

vaibhavvijay9 — Fri, 08 Feb 2019 07:49:51 GMT

Thanks @vishaltaneja07011993

Actually my exact field name was "ns0:ApplicationFunction" so when I used it without quotes in WHERE it was resulting in error.

But I renamed it as app and it worked.

So my final working string is :

....... | xmlkv | rename ns0:ApplicationFunction as app | WHERE app IN ("Price", "History", "Notify") | stats count by app

Thanks Again.

Re: How do you specify a list in WHERE condition?

vishaltaneja070 — Fri, 08 Feb 2019 07:55:00 GMT

@vaibhavvijay9

Great 🙂 Welcome 🙂

Good Luck