diff --git a/tools/backends.py b/tools/backends.py index 219793989..be1a1183c 100644 --- a/tools/backends.py +++ b/tools/backends.py @@ -464,10 +464,10 @@ class SplunkBackend(SingleTextQueryBackend): listSeparator = " " valueExpression = "\"%s\"" mapExpression = "%s=%s" - mapListsSpecialHandling = False + mapListsSpecialHandling = True mapListValueExpression = "%s IN %s" - def generateMapItemListNode(self, node): + def generateMapItemListNode(self, key, value): return "(" + (" OR ".join(['%s=%s' % (key, self.generateValueNode(item)) for item in value])) + ")" def generateAggregation(self, agg):