Is it possible to "expand" a single variable with comma-separated values into a "list" and then use it inside IN condition?
For example, I have a field "days-off" and want to filter events when "days-off" include "Sat"
So I would want something like
Search "Sat" IN (days-off)
May be with mvexpand?
Or should I just use matchor like against a string with regular expression (if required)?
No, it isn't.
use | where match(days-off,"Sat")
| where match(days-off,"Sat")
like() needs SQL-like %. match() is better.
View solution in original post