cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who rated this post

L2 Linker

I think what you are looking for it the "in" operator.

 

config timeframe = 7d
| dataset = xdr_data
| filter action_device_usb_vendor_name in ("vendor_A", "vendor_B", "vendor_C")
| fields X, Y, Z

View solution in original post

Who rated this post