Searching from a list of keywords
Example: "I need all log entries related to users 'jane', 'john', 'alice', and 'bob'."
Given a list of user identifiers, search my logs for log entries that match any of the user identifiers in the list. Something like the any() operator in python.
Is this possible?
Lets say you have parsed the user name in a field say USERNAME, then you can write something like
| parse ........ as USERNAME
| where USERNAME in ("Jane" OR "john" OR "alice" OR "bob")
You can refer to
Please sign in to leave a comment.