Splunk Search

Search a field for multiple values

tmarlette
Motivator

I am attempting to search a field, for multiple values.

this is the syntax I am using:

< mysearch > field=value1,value2 | table _time,field

The ',' doesn't work, but I assume there is an easy way to do this, I just can't find it the documentation.

Does anyone have any ideas?

Tags (1)
1 Solution

cphair
Builder

Use field=value1 OR field=value2.

View solution in original post

pkisplunk
Explorer

You can use the `IN` operator like:

error_code IN (4*, 500, 502, 503)

You can have both concrete values and wildcards.

 

See https://www.splunk.com/en_us/blog/tips-and-tricks/smooth-operator-searching-for-multiple-field-value...

Eze
Engager


field IN (value1,value2,value3)

Example:

index=network severity IN (low,high,medium)

0 Karma

cphair
Builder

Use field=value1 OR field=value2.

Georgin
Engager

Should value1 or value2 be enclosed in quotes?

0 Karma

ReddySk
Engager

Hello,
I am trying to combine it with my search string but no result is returned.

index=index1  type=transaction (host="host1" OR host="host2" OR host="host3")

What is wrong?

Thanks, Regards, Rudo

0 Karma

cphair
Builder

@Georgin: It doesn't have to be quoted unless the value itself contains separators. E.g. field=0 OR field=1 is fine, but you would have to use quotes for field="My String With Spaces".

0 Karma

splunkdevabhi
Explorer

Yes . You may include it

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...