Searching from a list of keywords
Example: "I need all log entries related to users 'jane', 'john', 'alice', and 'bob'."
Given a list of user identifiers, search my logs for log entries that match any of the user identifiers in the list. Something like the any() operator in python.
Is this possible?
-
Hi Mark,
Lets say you have parsed the user name in a field say USERNAME, then you can write something like
_collector=<collector_name>
| parse ........ as USERNAME
| where USERNAME in ("Jane" OR "john" OR "alice" OR "bob")You can refer to
https://help.sumologic.com/05Search/Search-Query-Language/Search-Operators/where
Regards
Please sign in to leave a comment.
Comments
1 comment