https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484523#M135628 <P>Why does the following string work:</P> <P><STRONG>url=*string1* OR url=*mystring2*</STRONG></P> <P>But, this one does not work?</P> <P><STRONG>url in (*mystring1*, *mystring2*)</STRONG></P> Wed, 29 Apr 2020 15:08:43 GMT lhumbertosplunk 2020-04-29T15:08:43Z https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484523#M135628 <P>Why does the following string work:</P> <P><STRONG>url=*string1* OR url=*mystring2*</STRONG></P> <P>But, this one does not work?</P> <P><STRONG>url in (*mystring1*, *mystring2*)</STRONG></P> Wed, 29 Apr 2020 15:08:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484523#M135628 lhumbertosplunk 2020-04-29T15:08:43Z https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484524#M135629 <P>Use <CODE>IN</CODE> (all caps).</P> Wed, 29 Apr 2020 16:55:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484524#M135629 richgalloway 2020-04-29T16:55:02Z https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484525#M135630 <P>Unbelievable. It accepted "in" as a reserved word (different color in syntax).</P> <P>Sucks being a newbie.</P> <P>Thank you!</P> Wed, 29 Apr 2020 17:12:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484525#M135630 lhumbertosplunk 2020-04-29T17:12:17Z https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484526#M135631 <P>Unbelievable! Sucks being a newbie.</P> <P>It accepted "in" as a reserved word (color change). Never crossed my mind to test "IN". Shame!</P> Wed, 29 Apr 2020 17:14:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-IN-clause-in-a-search-string/m-p/484526#M135631 lhumbertosplunk 2020-04-29T17:14:31Z