Splunk Search

Is it possible to use IN against a field that contains comma-separated values?

pm771
Communicator

Is it possible to "expand" a single variable with comma-separated values into a "list" and then use it inside IN condition?

For example, I have a field "days-off" and want to filter events when "days-off" include "Sat"

So I would want something like

Search "Sat" IN (days-off)

May be with mvexpand?

Or should I just use matchor like against a string with regular expression (if required)?

0 Karma
1 Solution

to4kawa
Ultra Champion

No, it isn't.

use | where match(days-off,"Sat")

like() needs SQL-like %. match() is better.

View solution in original post

to4kawa
Ultra Champion

No, it isn't.

use | where match(days-off,"Sat")

like() needs SQL-like %. match() is better.

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...