How to find several terms in all _raw ?

[mah]

Hi,

I want to find specific strings in all event in order to classify them into two values, like "if there is "A" or "B" or "C" so put it under "OK" value, if not put it in default value "KO".

I tried first this query :

| eval field=if(searchmatch("A"),"OK,"KO")

But I tried ("A" OR "B") and it does not work. 

I don't know how to add other strings in this command. 

Can you help me ?

[PickleRick · Accepted solution]

If you literarily tried

| eval field=if(searchmatch("A" OR "B"),"ok","ko")

You should have gotten an error because it's not a valid search string and also an OR operator needs two boolean expressions as arguments, not string.

If you want a search string "A" OR "B" OR "C", you have to escape the quotes within the string.

| eval field=if(searchmatch("\"A\" OR \"B\" OR \"C\""),"ok","ko")