Splunk Search

How to use IN clause in a search string?

New Member

Why does the following string work:

url=*string1* OR url=*mystring2*

But, this one does not work?

url in (*mystring1*, *mystring2*)

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Use IN (all caps).

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Use IN (all caps).

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

New Member

Unbelievable! Sucks being a newbie.

It accepted "in" as a reserved word (color change). Never crossed my mind to test "IN". Shame!

0 Karma

New Member

Unbelievable. It accepted "in" as a reserved word (different color in syntax).

Sucks being a newbie.

Thank you!

0 Karma