title: Determine if field is in a subset of values
body: <p>I'm writing a query to determine what percentage of events are error events for a camera-based system.</p>
  
  <p>To narrow logged events down to camera events, I have <code>event=camera*</code> in the initial query.</p>
  
  <p>What I want to do next is treat the event as bad if it's in a subset, so I want something like:</p>
  
  <pre><code>event=camera* | eval bad_event=IF(event IN (camera-failed, camera-error, ...))
  </code></pre>
  
  <p>but I am not sure of the correct syntax for this in Splunk.</p>
  
  <p>I tried <code>eval bad_event=IF(event=camera-failed OR event=camera-error)</code>, but got the message <em>Error in 'eval' command: The arguments to the 'if' function are invalid.</em></p>
  
  <p>How do I check if the event is in a subset of its possible values?</p>