- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

lhumbertosplunk
New Member
04-29-2020
08:08 AM
Why does the following string work:
url=*string1* OR url=*mystring2*
But, this one does not work?
url in (*mystring1*, *mystring2*)
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
04-29-2020
09:55 AM
Use IN
(all caps).
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
04-29-2020
09:55 AM
Use IN
(all caps).
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

lhumbertosplunk
New Member
04-29-2020
10:14 AM
Unbelievable! Sucks being a newbie.
It accepted "in" as a reserved word (color change). Never crossed my mind to test "IN". Shame!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

lhumbertosplunk
New Member
04-29-2020
10:12 AM
Unbelievable. It accepted "in" as a reserved word (different color in syntax).
Sucks being a newbie.
Thank you!
