I assumed "in" would allow a set of CSV values like tcp.stream in {1,8,12,18} but that results in syntax error.