Unsure if it was added recently, but Splunk Query Language does have VAL IN (1,2,3) now -> https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchRef...