inlist
Use the inlist operator to check if a field value is present in a lookup table column.
Syntax
|where <field_for_filtering_values> inlist (<lookup_table> <lookup_field>)
<field_for_filtering_values>
|
Specifies the name of the field to be used to filter the list of values. |
<lookup_table>
|
Specifies the lookup table name which contains the field with the list of values to filter. |
<lookup_field>
|
Specifies the name of the field in the |
Usage
You can use the inlist operator to check field values in a list. This list of values comes from a lookup table, causing it to be modified dynamically.
Examples
Example 1: Filter results for source IP addresses present in a blacklist lookup table.
| where src_ip inlist (BlackListLookup ip)Example 2: Filter results for users that match a contract employees lookup table.
| where user inlist (ContractEmployeesLookup user)Example 4: Counts OCSF events per destination IP, excluding any IPs that appear in the qa_tmp_table_aggr_test lookup table.
ocsf | fields dst_endpoint.hostname |where dst_endpoint.hostname inlist(ocsf_test_table dst_endpoint.hostname) | aggr count by dst_endpoint.hostname