Hi,
I have the following search that searches an index based on 2 textbook inputs:
| inputlookup ABC
| search src=$src_tok$ OR dest=$dest_tok$
I need to change this such that multiple src's or multiple dest's are inputted at a given time by a user.
Something like the following if dest="10.175.96.146 10.175.96.147 10.175.96.148 0.175.96.149 10.175.96.150 10.175.96.183":
| inputlookup ABC
| search src=* OR (dest=10.175.96.146 AND dest=10.175.96.147 AND dest= 10.175.96.148 AND dest=10.175.96.149 AND dest=10.175.96.150 AND dest=10.175.96.183)
How can I change my current search to search on multiple inputted values?
Thanks as always 🙂
Hi
maybe this helps you
| inputlookup ABC
| search src=* OR [
| makeresults
| eval dest="10.175.96.146 10.175.96.147 10.175.96.148 10.175.96.149 10.175.96.150 10.175.96.183"
| eval dest=split(dest," ")
| fields dest
| format mvsep="AND"]
r. Ismo