Defines one or more values in a single, ordered collection. If there is only a single value, for example "malware" then it can be used without the square brackets; if multiple values are required for the array, the array must be in square brackets, for example, ["a","b"].

in(severity, values="critical")

in(status, values=["active", "pending", "processing"])

cidr(field=ip_addr, subnet=["192.168.0.0/16", "10.0.0.0/8"])

["web-server-01", "web-server-02", "db-server-01"]

Functions using this Type: bucket(), cidr(), correlate(), createEvents(), defineTable(), dropEvent(), eval(), fieldset(), in(), kvParse(), match(), matchAsArray(), neighbor(), parseFixedWidth(), parseJson(), text:editDistanceAsArray()