Splunk Search

How can I use the IN operator after tstats to see if a list of strings exists in a field?

russell120k
Engager

Hi, I want to change this first (sanitized) query to use a data model instead but I'm unsure how to incorporate "[field] IN ([comma separated list])". 

 

 

search index=my_index _raw IN ("*test*" ,"*sale*", "*customer*", "*item*" , "*code*")
|transaction src maxspan=1h
|table _time src url

 

 


This is my latest  failed attempt:

 

|tstats values(Web.url) as urls FROM datamodel=Web by Web.src
|search urls IN("*test*" ,"*sale*", "*customer*", "*item*" , "*code*")
|table *

 

 

In the 2nd query, how can I use the IN operator after tstats to see if any one of strings  in a list (the wildcards are required) exists in a field?

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried WHERE field IN (values)?

|tstats values(Web.url) as urls FROM datamodel=Web where Web.url IN ("*test*" ,"*sale*", "*customer*", "*item*" , "*code*") by Web.src
|table *
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried WHERE field IN (values)?

|tstats values(Web.url) as urls FROM datamodel=Web where Web.url IN ("*test*" ,"*sale*", "*customer*", "*item*" , "*code*") by Web.src
|table *
---
If this reply helps you, Karma would be appreciated.
0 Karma

russell120k
Engager

This worked perfectly, thank you.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...