https://community.splunk.com/t5/Splunk-Dev/use-IN-command-with-subsearch/m-p/530839#M9533 <P>Hello<BR />i want to use IN command with subsearch like in the query above:</P><LI-CODE lang="markup">| tstats summariesonly=true allow_old_summaries=true max(_time) as _time, values("events.eventtype") as eventtype FROM datamodel=events_prod WHERE "events.kafka_uuid" IN ("search= [ | inputlookup kv_alerts_prod where _key="5f" | table uuids]") BY "events.kafka_uuid", "events.tail_id", "events._indextime", "events._raw", source, sourcetype</LI-CODE><P>this query returns no results.. what am i missing ?&nbsp;</P> Wed, 25 Nov 2020 14:39:25 GMT sarit_s 2020-11-25T14:39:25Z https://community.splunk.com/t5/Splunk-Dev/use-IN-command-with-subsearch/m-p/530839#M9533 <P>Hello<BR />i want to use IN command with subsearch like in the query above:</P><LI-CODE lang="markup">| tstats summariesonly=true allow_old_summaries=true max(_time) as _time, values("events.eventtype") as eventtype FROM datamodel=events_prod WHERE "events.kafka_uuid" IN ("search= [ | inputlookup kv_alerts_prod where _key="5f" | table uuids]") BY "events.kafka_uuid", "events.tail_id", "events._indextime", "events._raw", source, sourcetype</LI-CODE><P>this query returns no results.. what am i missing ?&nbsp;</P> Wed, 25 Nov 2020 14:39:25 GMT https://community.splunk.com/t5/Splunk-Dev/use-IN-command-with-subsearch/m-p/530839#M9533 sarit_s 2020-11-25T14:39:25Z https://community.splunk.com/t5/Splunk-Dev/use-IN-command-with-subsearch/m-p/530894#M9534 <P>Check the search log to see how Splunk is parsing that query.&nbsp; I suspect the contents of the IN argument is being treated literally instead of as a subsearch.</P><P>If the subsearch is being processed then it's possible it's not returning a valid argument for IN.&nbsp; Run the subsearch by itself with <FONT face="courier new,courier">| format</FONT> on the end to see the exact string returned.&nbsp; Adjust the subsearch as needed to make the returned value a valid IN argument.</P> Wed, 25 Nov 2020 20:55:24 GMT https://community.splunk.com/t5/Splunk-Dev/use-IN-command-with-subsearch/m-p/530894#M9534 richgalloway 2020-11-25T20:55:24Z