topic Use of == with or operator in Splunk Search https://community.splunk.com/t5/Splunk-Search/Use-of-with-or-operator/m-p/460430#M140123 <P>I want to compare some data with fields and then rename the data matched with fields. Since we have large set of data and comparing of all those data with fields it makes query bulky. Can anyone give efficient code for this??</P> <P>Example: stats count(eval(fieldname=="some data" OR fieldname=="some data")) as XYZ count(eval(fieldname=="some data" OR fieldname=="some data" OR fieldname=="some data" fieldname=="some data" fieldname=="some data"fieldname=="some data"fieldname=="some data"fieldname=="some data"fieldname=="some data")) as ABC..............by fieldname</P> <HR /> Fri, 05 Jun 2020 23:11:50 GMT arabhi 2020-06-05T23:11:50Z Use of == with or operator https://community.splunk.com/t5/Splunk-Search/Use-of-with-or-operator/m-p/460430#M140123 <P>I want to compare some data with fields and then rename the data matched with fields. Since we have large set of data and comparing of all those data with fields it makes query bulky. Can anyone give efficient code for this??</P> <P>Example: stats count(eval(fieldname=="some data" OR fieldname=="some data")) as XYZ count(eval(fieldname=="some data" OR fieldname=="some data" OR fieldname=="some data" fieldname=="some data" fieldname=="some data"fieldname=="some data"fieldname=="some data"fieldname=="some data"fieldname=="some data")) as ABC..............by fieldname</P> <HR /> Fri, 05 Jun 2020 23:11:50 GMT https://community.splunk.com/t5/Splunk-Search/Use-of-with-or-operator/m-p/460430#M140123 arabhi 2020-06-05T23:11:50Z Re: Use of == with or operator https://community.splunk.com/t5/Splunk-Search/Use-of-with-or-operator/m-p/460431#M140124 <P>make CSV for lookup and use <CODE>lookup</CODE> command<BR /> and aggregate the output </P> Sun, 24 May 2020 00:00:27 GMT https://community.splunk.com/t5/Splunk-Search/Use-of-with-or-operator/m-p/460431#M140124 to4kawa 2020-05-24T00:00:27Z Re: Use of == with or operator https://community.splunk.com/t5/Splunk-Search/Use-of-with-or-operator/m-p/460432#M140125 <P>Hello @arabhi,</P> <PRE><CODE> stats count(eval(fieldname IN ("value1", "value2", "value3"))) AS XYZ </CODE></PRE> Sun, 24 May 2020 11:46:34 GMT https://community.splunk.com/t5/Splunk-Search/Use-of-with-or-operator/m-p/460432#M140125 PavelP 2020-05-24T11:46:34Z