Splunk Search

How to use IN clause in a search string?

New Member

Why does the following string work:

url=*string1* OR url=*mystring2*

But, this one does not work?

url in (*mystring1*, *mystring2*)

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Use IN (all caps).

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Use IN (all caps).

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Unbelievable! Sucks being a newbie.

It accepted "in" as a reserved word (color change). Never crossed my mind to test "IN". Shame!

0 Karma

New Member

Unbelievable. It accepted "in" as a reserved word (different color in syntax).

Sucks being a newbie.

Thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!