Splunk Search

Can I use the "IN" command like this?

twjack
Explorer
index=myIndex FieldA="A" AND LogonType IN (4,5,8,9,10,11,12)

The documentation says it is used with "eval" or "where" and returns only the value "true".

But it also seems to work as described above.

Now I'm unsure if this is "failsafe" as an initial search...

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Not sure what documentation you are referring to, but yes, since Splunk v6.6.0 you can also use it like that. See the documentation for the search command: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search#Multiple_field-value_comp...

View solution in original post

0 Karma

FrankVl
Ultra Champion

Not sure what documentation you are referring to, but yes, since Splunk v6.6.0 you can also use it like that. See the documentation for the search command: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search#Multiple_field-value_comp...

0 Karma

twjack
Explorer

Holy crap, I actually looked in the wrong documentation. I must have been blind. Thank you.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...