Search code examples
splunksplunk-querysplunk-dashboard

Separate multiple search values with an OR clause with Splunk?

I have a text box in a Splunk dashboard, and I'm trying to find out how I can separate values entered into the text box that are separated by commas with an OR clause.

For example:

values entered into text box: 102.99.99, 103.99.93, 203.23.21

index=abc sourcetype=abc src_ip="$ip$"

Any suggestions?

Solution

  • What about using the IN operator?

    index=abc sourcetype=abc src_ip IN ($ip$)