Splunk Search

How to use IN clause in a search string?

lhumbertosplunk
New Member

Why does the following string work:

url=*string1* OR url=*mystring2*

But, this one does not work?

url in (*mystring1*, *mystring2*)

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Use IN (all caps).

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use IN (all caps).

---
If this reply helps you, Karma would be appreciated.
0 Karma

lhumbertosplunk
New Member

Unbelievable! Sucks being a newbie.

It accepted "in" as a reserved word (color change). Never crossed my mind to test "IN". Shame!

0 Karma

lhumbertosplunk
New Member

Unbelievable. It accepted "in" as a reserved word (different color in syntax).

Sucks being a newbie.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...