TQL syntax supports lists of comma-separated values by placing the list between square brackets “[]”. For example:
srcip:["192.68.1.1","192.68.1.2"]
Multiple fields can be searched simultaneously by separating field values by a comma and enclosing them in square brackets on the left-hand side of your query. For example:
[srcipv4,dstipv4]:"192.168.1.1"
Result: returns either srcipv4 or dstipv4 that are 192.168.1.1.
[srcipv4,dstipv4]:["192.168.1.1","192.168.1.2"]
Result: returns results with srcipv4 that include 192.168.1.1 or 196.168.1.2 or returns results with dstipv4 that include 196.168.1.1 or 196.168.1.2.
Lists can also switch between conjunction and disjunction by using the and/or prefix operators. For example:
&[srcipv4,dstipv4]:"192.168.1.1"
Result: returns if both srcipv4 and dstipv4 are 192.168.1.1
&[rawmsg,domain]!:["google","facebook"]
Result: returns if both rawmsg and domain have neither google nor facebook
&[rawmsg,domain]:&["google","cloud"]
Result: returns if both rawmsg and domain have both Google and cloud
List syntax contained inside of queries also allows for heterogeneous operations. For example:
rawmsg:[/192.168/,tcp,ERROR*]
Result: query would expand to a regular expression against rawmsg, a search for the term tcp in rawmsg, or a prefix query for ERROR* in rawmsg.