I have the following search with
index=index1 host=host1 elementType=ET measInfoId=117440551 OR measInfoId=117440572 OR measInfoId=117490518 |
Is there a better way of writing the OR part of this search, be it shorter or more efficient?
measInfoId=117440551 OR measInfoId=117440572 OR measInfoId=117490518
try like this:
measInfoId=1174(40551 OR 40572 OR 90518 ) ex: index=index1 host=host1 elementType=ET measInfoId=1174(40551 OR 40572 OR 90518 )
Tried both these and they did not work
... measInfoId=1174(40551 OR 40572 OR 90518)
There isn't a quick and easy way to make this perform better / be more efficient. Splunk's use of boolean AND/OR/NOT is generally very efficient up until you have several thousand terms in your search.
Syntactically, though, you may want something to sweeten it. Folks have brought up before the concept of
field IN (aaa,bbb,ccc) as syntactic sugar around OR. This doesn't exist though.
If your list of items is LONG (tens / hundreds) you can make a CSV file and use a lookup, say called
measInfoId.csv like so:
measInfoId 117440551 117440572 117490518
And then use the
inputlookup command to drag it in. It produces the same long list of
OR statements just without putting your "O" and "R" keys through such a workout.
index=index1 host=host1 elementType=ET [ | inputlookup measInfoId.csv ]