is there an 'ISIN' function ins splunk?

[ccfenix]

Hi,

in some table-oriented programming languages, there is an 'isin' function which returns true if the input is in a given set e.g. in python pandas we can do

country.isin(['UK', 'USA', 'FR', 'JP'])

is there something like this in splunk?

ISIN(country, ['UK', 'USA', 'FR', 'JP'])

thanks a lot!

[martin_mueller]

Subsearches mimic this behaviour by building OR'd chains. Assume your list is stored in a lookup, then you can do this:

some search stuff [inputlookup country_list | fields country]

That'll build an OR'd list for each row in the lookup, for your example country=UK OR country=USA OR country=FR OR country=JP.