Hi @SSJMBP you can use the IN operator when you want to determine if a field contains one of several values. This can make your search queries cleaner and easier to read.   For example, instead of using multiple OR conditions, you can use:   sourcetype="fraud_detection.csv" fraud="1" gender IN ("F", "M")   This ensures that the filter applies correctly to include events with either gender "F" or "M". Ref: Search Reference    Additionally, as already suggest by ITWhisperer, please try always to include a few anonymized example events. This makes it easier for all contributors to understand the dataset you are working with and provide more accurate support.   best regards, ... View more