How can I use the IN operator after tstats to see if a list of strings exists in a field?

[russell120k]

Hi, I want to change this first (sanitized) query to use a data model instead but I'm unsure how to incorporate "[field] IN ([comma separated list])". 

search index=my_index _raw IN ("*test*" ,"*sale*", "*customer*", "*item*" , "*code*")
|transaction src maxspan=1h
|table _time src url

This is my latest  failed attempt:

|tstats values(Web.url) as urls FROM datamodel=Web by Web.src
|search urls IN("*test*" ,"*sale*", "*customer*", "*item*" , "*code*")
|table *

In the 2nd query, how can I use the IN operator after tstats to see if any one of strings  in a list (the wildcards are required) exists in a field?

[richgalloway · Accepted solution]

Have you tried WHERE field IN (values)?

|tstats values(Web.url) as urls FROM datamodel=Web where Web.url IN ("*test*" ,"*sale*", "*customer*", "*item*" , "*code*") by Web.src
|table *

[russell120k]

This worked perfectly, thank you.