Can I consolidate multiple arbitrary strings into an 'include file' so I can filter based on all of them?

[dreeck]

Greetings,

I'd like to remove some spurious errors from my application by filtering them out. Each error is distinct, and they all have a common format. As per usual, my application deals with fruit. How can I filter out the following 7 errors without having to make each one a literal string?

Examples I want to filter out:

• "This fruit is rotten"
• "A blemish has this fruit"
• "Brown spots appear" "This
• "fruit smells like a banana, but is not a banana"
• "Smooshy, way too smooshy"
• "Hard like a rock"

Examples I still want to keep in:

• "This is a rock, not fruit"
• "This fruit has metal embedded in it"
• "Mangled beyond recognition"

My assumption is that I will have to create a search string which specifically 'NOTs' all of the examples in the top list.

[woodcock · Accepted solution]

You can do this with a subsearch:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchTutorial/Useasubsearch

OR if you are on the latest version of Splunk, with the IN operator (hooray for @richfez):
http://docs.splunk.com/Documentation/Splunk/6.6.2/SearchReference/ConditionalFunctions#in.28VALUE-LI...