Is there a better way to do an OR in Splunk?
api_domain="purchase" OR api_domain="user" OR api_domain="testX"
I assume there is something like api_domain="x" OR "y" OR "z" but but doesn't seem to fly.
api_domain="x" OR "y" OR "z"
Also, if you are after the base search (post-pipe) and don't care about doing this work non-map-reduced (only at the search head), you can do things like this:
... | regex api_domain="^(purchase|user|testX)$"
... | where match(api_domain, "^(purchase|user|testX)$")
That is the normal way and I do not see much reason to deviate.
Let's say that you have a long list of things in a single string or field, you can do it like this:
This part creates a string of sufff (purely for creating something to demonstrate upon):
| noop | stats count AS api_domain | eval api_domain = "purchase, user, testX"
Then you can do something like this:
| makemv delim="," api_domain | format
Then you can use it in outer search like this:
index = blah [| noop | stats count AS api_domain | eval api_domain = "purchase, user, testX" | makemv delim="," api_domain]