Multiple where values

[ashishlal82]

how can I use multiple values in where clause

for ex:index=xyz sourcetype=abc | dedup name | where name="2009-2274" 2009-2271"

This is giving me an error, can I use OR clause to get field values for the above mentioned values

[DalJeanis]

Yes, you can use OR. The actual issue there is probably that you are missing the word OR and missing a quote before the value 2009-2271.

[jbanerje]

Multiple conditions can be checked by the where clause as shown below :

| inputlookup test.csv | where like(field1, "IP") and not like(field2, "Pass")

[sundareshr]

Yes, you can use OR, like this where name="abc" OR name="xyz" OR you can use ... | search name="abc" OR name="xyz". Having said that, you should always try to reduce as much as you can in the first (implicit) search command in terms of efficiency. So I would change your query to

index=xyz sourcetype=abc (name="2009-2274" OR name="2009-2271") | dedup name