topic Re: Can I use the "IN" command like this? in Splunk Search

Can I use the "IN" command like this?

twjack — Wed, 10 Jul 2019 10:00:19 GMT

index=myIndex FieldA="A" AND LogonType IN (4,5,8,9,10,11,12)

The documentation says it is used with "eval" or "where" and returns only the value "true".

But it also seems to work as described above.

Now I'm unsure if this is "failsafe" as an initial search...

FrankVl — Wed, 10 Jul 2019 10:34:54 GMT

Not sure what documentation you are referring to, but yes, since Splunk v6.6.0 you can also use it like that. See the documentation for the search command: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search#Multiple_field-value_comparisons_with_the_IN_operator

twjack — Wed, 10 Jul 2019 14:02:57 GMT

Holy crap, I actually looked in the wrong documentation. I must have been blind. Thank you.