I have a subsearch doing "| inputlookup" against a CSV... the implied operator is equals. "Column/Field = Cell Value" ... is anybody aware of a way to overload or modify that operator from equals to IN. For example, if my cell value is a comma-separated list value1,value2 I dont want the search to be field="value1,value2" I would want the search to be field IN (value1,value2)
|tstats count WHERE [inputlookup test.csv]
Desired expanded search:
|tstats count WHERE mycolumn IN (value1,value2)
Actual expanded search:
| tstats count WHERE mycolumn="value1,value2"
definition = rename COMMENT AS "EXTREME WARNING!!! THIS IS ONLY VALID IF YOU ARE USING A SINGLE FIELD!!!!"\
| rex field=search mode=sed "s/^\(\s*\(\s*// s/\s*\)\s*\)$/)/ s/=/ IN(/ s/\s*\)\s*OR\s*\([^=]+=/,/g"
errormsg = Description: Author=Gregg Woodcock; this is necessary because if the number of characters in a search string is too great, the search may fail; this conversion saves ~50%!
iseval = 0
Then, any place where you are doing something like this: