Reduce SPL OR operator redundancy

torirgee · ‎06-19-2019

I have a query with a bunch of ORs and I want to do something similar to the SQL IN operator, using a list instead or var=this OR var=that a bunch of times. Is there anything in Splunk SPL to reduce OR redundancy?

niketn · ‎06-19-2019

@torirgee IN Operator is available in Splunk from version 6.6 and above.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Reduce SPL OR operator redundancy

Splunk Observability for AI

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Splunk Observability as Code: From Zero to Dashboard

Are you a member of the Splunk Community?

Reduce SPL OR operator redundancy

Splunk Observability for AI

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Splunk Observability as Code: From Zero to Dashboard