TQL syntax supports lists of comma-separated values by placing the list between square brackets “[]”. For example:
network.srcIp:["192.68.1.1","192.68.1.2"]
Multiple fields can be searched simultaneously by separating field values by a comma and enclosing them in square brackets on the left-hand side of your query. For example:
[network.dstIp,network.srcIp]:"192.68.1.2"
Result: returns either network.dstIp or network.srcIp that are 192.68.1.2.
[network.dstIp,network.srcIp]:["192.68.1.1","192.68.1.2"]
Result: returns results with network.dstIp that include 192.68.1.1 or 192.68.1.2 or returns results with network.srcIp that include 192.68.1.1 or 192.68.1.2.
Apply AND/OR logic to lists using prefix operators. For example:
&[network.dstIp,network.srcIp]:["192.68.1.1"]
Result: returns if both network.dstIp and network.srcIp are 192.68.1.1.
&[cmdLine,domain]!:["google","facebook"]
Result: returns if both cmdLine and domain have neither google nor facebook.
&[cmdLine,domain]:&["google","facebook"]
Result: returns if both cmdLine and domain have both google and facebook.
List syntax contained inside of queries also allows for heterogeneous operations. For example:
cmdLine:[/192.68/,tcp,ERROR*]
Result: query would expand to a regular expression against cmdLine, a search for the term tcp in cmdLine, or a prefix query for ERROR* in cmdLine.