topic How to check if a value exists in a list of values? in Splunk Search

How to check if a value exists in a list of values?

sdhiaeddine — Wed, 22 Feb 2023 17:24:14 GMT

Hi,

I'm filtering a search to get a result for a specific values by checking it manually this way:

.... | stats sum(val) as vals by value | where value="v1" OR value="v2" OR value="v3"

I'm wondering if it is possible to do the same by checking if the value exists in a list coming from another index:
(something like this)

.... | append [search index=another_index
| stats values(remote_value) as values_list]
| stats sum(val) as vals by value | where (value in values_list)

Re: Check if a value exists in a list of values

DanielPriceUK — Wed, 22 Feb 2023 16:56:24 GMT

| search values IN("v1",V2",V3")

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search#Multiple_field-value_comparisons_with_the_IN_operator

Re: Check if a value exists in a list of values

DanielPriceUK — Wed, 22 Feb 2023 16:58:26 GMT

use subsearches and the format command for the rest if you want to populate the comma seperated list with values from a search