Improved SMF WHERE Clause Filtering with New IN/NOTIN Operators (PTF SDF2177) - ironstream_for_servicenow_discovery_1 - Latest

Ironstream for Splunk®/Kafka®/Elastic® for IBM Z® Release Notes

Product type
Software
Portfolio
Integrate
Product family
Ironstream
Product
Ironstream > Ironstream for Kafka®
Ironstream > Ironstream for Splunk®
Ironstream > Ironstream for Elastic®
Version
Latest
Language
English
Product name
Ironstream for Splunk®/Kafka®/Elastic® for IBM Z®
Title
Ironstream for Splunk®/Kafka®/Elastic® for IBM Z® Release Notes
First publish date
2014
Last updated
2024-09-26
Published on
2024-09-26T07:29:10.702304

The SMF WHERE clause filtering has been further enhanced with new IN/NOTIN comparison operators. These operators allow you to create more concise and efficient SMF field search conditions when compared to searching via numerous conditions connected by multiple AND/OR comparisons.

  • The IN operator returns a TRUE condition if a match is found in the list of values.

    "WHERE":"field1 IN ('string_1','string_2',...,'string_n')"
  • The NOTIN operator returns a TRUE condition if no match is found in the list of values.

    "WHERE":"field1 NOTIN ('string_1','string_2',...,'string_n')"
    

For more information, refer to the “SMF Record Filtering” chapter in the Ironstream Configuration and User’s Guide.