Hi People,
Is there any efficient way of grouping values?
I have like 20 Or statement that I need to match
something like
("x" OR "Y" OR "Z" OR "A" OR "B" OR "C")
Is there any expression like
any of (x,y,z,a,b,c) ?
@babakkhorshid,
Try,
field_name IN(x,y,z,a,b,c)
Reference : Multiple field-value comparisons with the IN operator
@babakkhorshid,
Try,
field_name IN(x,y,z,a,b,c)
Reference : Multiple field-value comparisons with the IN operator
Thanks Renjith
I think this would solve my issue.
But out of interest:
What if the field_Name is not the same.
Like we have Multiple events (like Phrases or words we need to match) in multiple fields?
example: "200" "201" "202" "203" "204" in fields A, B and C
Much appreciate your help and Thanks
@babakkhorshid ,
Thanks. Please accept as answer if it's working for you.
For handling different field name, you may use field alias and use the alias in search as described in https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Addaliasestofields