in()

The in() function returns true if the evaluated result of the first argument matches any of the remaining arguments, and false otherwise.

Syntax

Parameters

NEEDLE

The expression to search for.

VAL1, VAL2, ...

The list of values to compare against NEEDLE. Wildcard * can be used in string values.

Description

The in() function evaluates NEEDLE and then compares it against the remaining values in order. Matching is determined by the following rules:

• If a comparison value is a string that does not contain *, an exact match is performed.
• If a comparison value is a string that contains *, a wildcard pattern match is performed. * matches any sequence of characters.
• If a comparison value is a non-string expression such as a number or boolean, the evaluated result is compared.

If NEEDLE is null, the function returns false.

If any value matches, true is returned immediately. The return type is always boolean.

Error codes

N/A

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

1. Check whether the HTTP method matches one of the listed values

   table limit=5 WEB_APACHE_SAMPLE | eval result = in(method, "GET", "POST") | fields method, result
   

2. Filter records that match specific HTTP methods

   table limit=5 WEB_APACHE_SAMPLE | search in(method, "GET", "POST")
   | # Only GET or POST request records are returned.
   

3. Partial match on User-Agent using wildcards

   table limit=5 WEB_APACHE_SAMPLE | eval result = in(agent, "*Googlebot*", "*bingbot*") | fields agent, result
   

4. Compare against a list of status codes

   table limit=5 WEB_APACHE_SAMPLE | eval result = in(status, 200, 301, 302) | fields status, result
   

5. NULL input

   json "{'method': null}" | eval result = in(method, "GET", "POST")
   | # result: false
   

Compatibility

The in() function is available since before Sonar 4.0.