Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is there a best practice for creating a multivalue field instead of writing a search with a lot of OR statements?

$
0
0
I need to search through my email logs to determine who sends emails to personal accounts (e.g. gmail, yahoo, etc). Right now my search looks like this: index=exchange_logs recipient_domain="yahoo.com" OR recipient_domain="gmail.com" OR recipient_domain="google.com" OR recipient_domain="hotmail.com" OR recipient_domain="hotmail.co.uk" ..... When I want to add new personal email domains, I need to edit the search and manually add another "OR" line. I was wondering if I can create a multivalue field that will contain all personal domains and then create a search where `recipient_domain=*any value from the multivalue field*`. This will make my search look much cleaner. p.s. I was able to create a multivalue field that looks like this: `"comcast.net aol.com att.net yahoo.com hotmail.com gmail.com"`, but now I don't know how to compare recipient_domain to each value.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>