Search for a specific subset of values

[neilamoran]

Hi,

Not sure if the problem is the way I'm phrasing my query, but I'm having trouble finding anything that seems (to me, at least) related, so asking for the wisdom of the crowd instead.

If I'm looking for events with a particular subset of values of field x, is there a syntax, command or construction that can save me from typing:

index=myindex source=mysource (myfield=a OR myfield=b OR myfield=c OR myfield=d OR myfield=e)

Can I do something like:

index=myindex source=mysource myfield=in(a,b,c,d,e)

Or, even better:

index=myindex source=mysource myfield=in(a,c-e,h,j-q)

Thus returning all events where the value of myfield is a, c, d, e, h, j, k, l, m, n, o, p or q. I say this just to be really certain I'm explaining myself, and not to seem patronising, I hope. Ideally this would work with numerical values and expressions as well.

Sorry if this is completely obvious and I'm being thick - suffering a little from baby related lack of sleep(!) - just seems like it would be useful functionality and I'm far more certain that I have failed to spot how to do it than that it isn't there at all. Hey - if not, maybe there's room for a feature request!

Thanks in advance,

Neil

[neilamoran]

Thought I'd just comment on this to see if there's been any change - I've recently bemoaned its lack again when looking through Windows event logs, particularly here I'm looking for a number of different EventCodes, which aren't necessarily sequential so I can't just use less than/greater than to specify a range.

I know I could use macros, or eventtypes (and do, for some things) but its the ad hoc usage that I would really like to see.

Anyone? Bueller?

[sdaniels]

You could use a macro if this is something you are going to re-use frequently. There isn't a command to do what you want as far as i know unless you create your own custom search command.

http://docs.splunk.com/Documentation/Splunk/5.0/Search/Usesearchmacros

Here is an example of a macro:

http://wiki.splunk.com/Community:Plotting_a_linear_trendline