Splunk Search

How can I use the IN operator after tstats to see if a list of strings exists in a field?

russell120k
Engager

Hi, I want to change this first (sanitized) query to use a data model instead but I'm unsure how to incorporate "[field] IN ([comma separated list])". 

 

 

search index=my_index _raw IN ("*test*" ,"*sale*", "*customer*", "*item*" , "*code*")
|transaction src maxspan=1h
|table _time src url

 

 


This is my latest  failed attempt:

 

|tstats values(Web.url) as urls FROM datamodel=Web by Web.src
|search urls IN("*test*" ,"*sale*", "*customer*", "*item*" , "*code*")
|table *

 

 

In the 2nd query, how can I use the IN operator after tstats to see if any one of strings  in a list (the wildcards are required) exists in a field?

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried WHERE field IN (values)?

|tstats values(Web.url) as urls FROM datamodel=Web where Web.url IN ("*test*" ,"*sale*", "*customer*", "*item*" , "*code*") by Web.src
|table *
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried WHERE field IN (values)?

|tstats values(Web.url) as urls FROM datamodel=Web where Web.url IN ("*test*" ,"*sale*", "*customer*", "*item*" , "*code*") by Web.src
|table *
---
If this reply helps you, an upvote would be appreciated.
0 Karma

russell120k
Engager

This worked perfectly, thank you.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...