I have a subsearch doing "| inputlookup" against a CSV... the implied operator is equals. "Column/Field = Cell Value" ... is anybody aware of a way to overload or modify that operator from equals to IN. For example, if my cell value is a comma-separated list value1,value2 I dont want the search to be field="value1,value2" I would want the search to be field IN (value1,value2)
Example search:
|tstats count WHERE [inputlookup test.csv]
Example: test.csv:
mycolumn
value1,value2
Desired expanded search:
|tstats count WHERE mycolumn IN (value1,value2)
Actual expanded search:
| tstats count WHERE mycolumn="value1,value2"
... View more