Is there a limitation on the number of search boolean clauses (i.e. OR, AND) within a search string?
For example | search 'user1' OR 'user2' OR 'user3' OR ... 'user180'
It seems like the color of OR changes from orange to black after a certain number.
(I know need to figure out a way to shorten string due to blah, blah..)
@jcart11entergy
I don't think there is a limit of boolean clauses you will reach easily. After a while the "syntax highlighting function" simply gives up to highlight the "OR" 's appropriately.
But you really need to figure out a way to shorten the string.
I already found a solution for you. Lookup Tables!
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Lookup