https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431405#M173314 <P>Here file name is the field in the event</P> Wed, 30 Jan 2019 01:23:15 GMT vnravikumar 2019-01-30T01:23:15Z https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431401#M173310 <P>Hi Team,</P> <P>I have a list of 200 filenames (string) that need to be searched in Splunk. Each filename is unique.</P> <P>example - if I have filenames like 1.txt, 2.txt, 3.txt ........ 200.txt</P> <P>I am trying it like below - </P> <PRE><CODE>(1548225008333.4546.-1092053882.Oxalis_jhsediapp02.netsentral.no.doc.xml OR 1126864-1548236892-8712_ehfd.jcloud.no.doc.xml) | </CODE></PRE> Tue, 29 Jan 2019 15:13:11 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431401#M173310 arunkumardhiman 2019-01-29T15:13:11Z https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431402#M173311 <P>You can create a lookup with all the 20 filenames and the use a sub-search - see examples in <A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Aboutsubsearches">https://docs.splunk.com/Documentation/Splunk/7.2.3/Search/Aboutsubsearches</A></P> <P>Also, within your data, if you have a field that has the filename, pls extract it, as it will come handy when you use sub-search.</P> Tue, 29 Jan 2019 15:57:56 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431402#M173311 lakshman239 2019-01-29T15:57:56Z https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431403#M173312 <P>Hi @arunkumardhiman</P> <P>Try like</P> <PRE><CODE>| makeresults | eval filename="1.txt" | where in(filename,"1.txt","2,txt","3.txt") </CODE></PRE> Tue, 29 Jan 2019 16:01:59 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431403#M173312 vnravikumar 2019-01-29T16:01:59Z https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431404#M173313 <P>I think I did confuse you.<BR /> I have a raw data in Splunk into which I have to first find all the events containing those filenames and then to extract the values from those events only.</P> Tue, 29 Jan 2019 19:48:02 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431404#M173313 arunkumardhiman 2019-01-29T19:48:02Z https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431405#M173314 <P>Here file name is the field in the event</P> Wed, 30 Jan 2019 01:23:15 GMT https://community.splunk.com/t5/Splunk-Search/how-to-search-multiple-strings/m-p/431405#M173314 vnravikumar 2019-01-30T01:23:15Z