How to check if a value exists in a list of values?

[sdhiaeddine]

Hi,

I'm filtering a search to get a result for a specific values by checking it manually this way:

.... | stats sum(val) as vals by value | where value="v1" OR value="v2" OR value="v3"

I'm wondering if it is possible to do the same by checking if the value exists in a list coming from another index:
(something like this)

.... | append [search index=another_index
| stats values(remote_value) as values_list]
| stats sum(val) as vals by value | where (value in values_list)

[DanielPriceUK]

| search values IN("v1",V2",V3")

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search#Multiple_field-value_comp...

[DanielPriceUK]

use subsearches and the format command for the rest if you want to populate the comma seperated list with values from a search