Splunk Search

Search a field for multiple values

tmarlette
Motivator

I am attempting to search a field, for multiple values.

this is the syntax I am using:

< mysearch > field=value1,value2 | table _time,field

The ',' doesn't work, but I assume there is an easy way to do this, I just can't find it the documentation.

Does anyone have any ideas?

Tags (1)
1 Solution

cphair
Builder

Use field=value1 OR field=value2.

View solution in original post

pkisplunk
Explorer

You can use the `IN` operator like:

error_code IN (4*, 500, 502, 503)

You can have both concrete values and wildcards.

 

See https://www.splunk.com/en_us/blog/tips-and-tricks/smooth-operator-searching-for-multiple-field-value...

Eze
Engager


field IN (value1,value2,value3)

Example:

index=network severity IN (low,high,medium)

0 Karma

cphair
Builder

Use field=value1 OR field=value2.

Georgin
Engager

Should value1 or value2 be enclosed in quotes?

0 Karma

ReddySk
Engager

Hello,
I am trying to combine it with my search string but no result is returned.

index=index1  type=transaction (host="host1" OR host="host2" OR host="host3")

What is wrong?

Thanks, Regards, Rudo

0 Karma

cphair
Builder

@Georgin: It doesn't have to be quoted unless the value itself contains separators. E.g. field=0 OR field=1 is fine, but you would have to use quotes for field="My String With Spaces".

0 Karma

splunkdevabhi
Explorer

Yes . You may include it

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...