https://community.splunk.com/t5/Splunk-Cloud-Platform/sub-search-not-working/m-p/667440#M2615 <P>i want the sub query search result which is a list of tracking id in my main query in clause but none of them are working.<BR />subquery and main working individually but after combining both it's not working, i tried with 3 different option but none of the below are working<BR /><BR /><BR /><BR />1.<BR />index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" | where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) as trackingID | eval trackingid="\"".mvjoin(trackingid,"\",\"")."\""])<BR /><BR />2.<BR />index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" |where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) as trackingid | table trackingid | stats values(eval("\"".trackingid."\"")) as search delim="," | nomv search])<BR /><BR />3.<BR />index="dockerlogs-silver" "Handle 500 Server error" OR "Handle 4xx error" |where traceID IN ([index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) | format]) |table traceID</P> Mon, 06 Nov 2023 06:25:59 GMT csahoo 2023-11-06T06:25:59Z https://community.splunk.com/t5/Splunk-Cloud-Platform/sub-search-not-working/m-p/667440#M2615 <P>i want the sub query search result which is a list of tracking id in my main query in clause but none of them are working.<BR />subquery and main working individually but after combining both it's not working, i tried with 3 different option but none of the below are working<BR /><BR /><BR /><BR />1.<BR />index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" | where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) as trackingID | eval trackingid="\"".mvjoin(trackingid,"\",\"")."\""])<BR /><BR />2.<BR />index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" |where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) as trackingid | table trackingid | stats values(eval("\"".trackingid."\"")) as search delim="," | nomv search])<BR /><BR />3.<BR />index="dockerlogs-silver" "Handle 500 Server error" OR "Handle 4xx error" |where traceID IN ([index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) | format]) |table traceID</P> Mon, 06 Nov 2023 06:25:59 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/sub-search-not-working/m-p/667440#M2615 csahoo 2023-11-06T06:25:59Z https://community.splunk.com/t5/Splunk-Cloud-Platform/sub-search-not-working/m-p/667476#M2616 <P>Try something like this</P><LI-CODE lang="markup">index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" | where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats count by traceID | eval search="\"".traceID."\"" | stats values(search) as search | eval search = mvjoin(search,",")])</LI-CODE> Mon, 06 Nov 2023 09:55:03 GMT https://community.splunk.com/t5/Splunk-Cloud-Platform/sub-search-not-working/m-p/667476#M2616 ITWhisperer 2023-11-06T09:55:03Z