one of the field value showing results which didn't search

[senthild]

one for the search query  from splunk AWS 

index="aws_cloud" | search eventname="value1" OR "value2" OR "value3" 

The above search query is giving the events for the all the above searched one also giving one more value which didn't searched 

eventName: LookupEvents ==> getting this field and value which didn't search 

[dtburrows3 · Accepted solution]

try this instead

 index="aws_cloud" eventName IN ("value1", "value2", "value3") 

I believe the format you posted is searching eventName="value1" OR any raw log containing the strings "value2" OR "value3" even if "value2" OR "value3" isn't the actual value of eventName for that particular event.