Trying to get eval to push multiple values to one field

[doingathing]

Currently trying to get eval to give multiple returns

| eval mitre_category="persistence,Defense_Evasion"
| eval apt="apt1,apt2,apt3"

I would like the values to be listed as OR. that way i get `apt2` or `apt3` instead of searching for `apt1,apt2,apt3`. I would like to know if there is a way to do this via one query instead of several if at all possible.

[richgalloway · Accepted solution]

Create a multi-value field using mvappend (there are other ways, too).

| eval mitre_category=mvappend("persistence","Defense_Evasion")
| eval apt=mvappend("apt1","apt2","apt3")

The search command, however, doesn't work well with multi-value fields so this probably will not solve your problem.  What problem are you trying to solve, exactly?  Tell us about the root problem so we can offer other possible answers.

[ITWhisperer]

It is not clear what you are trying to do. Are you trying to search for events where the field may have one of a number of different values?

| search apt IN ("apt1","apt2","apt3")