Splunk Search

How to put field values in a table to call in a search instead of using OR boolean directive?

Path Finder

I am currently using the below query...
index=a field1="ABC" | join id [Search index=a AND (field2="B" OR field2="C" field2="D"...)]

But I have 85 distinct values for field2..., so instead of providing too many logical/OR expressions is there a way I can put all these values A, B, C, D ....& Z in a table and write something like...search if field2 is in the table...?

Tags (3)
0 Karma

Revered Legend

Try something like this

index=a field1="ABC" 
| join id [Search index=a [Search index=a | stats count by field2 | return field2]]

The innermost subsearch "[Search index=a | stats count by field2 | return field2]" will return 'OR' separate values to field2 to be used for subsearch.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>