topic Error in 'fields' command: Invalid argument: 'Account_Name=HELP' in Splunk Search

Error in 'fields' command: Invalid argument: 'Account_Name=HELP'

splunk_zen — Fri, 12 Apr 2019 16:35:02 GMT

How to correct this SPL to avoid this error

index=win EventCode=528 OR EventCode=4624 LogonType=2 
| fields Account_Name
[ | inputlookup identities_1
 | inputlookup append=true identities_2
 | inputlookup append=true identities_3
|  rename identity as Account_Name
|  fields Account_Name watchlist
|  where watchlist = "true"    
]

Error in 'fields' command: Invalid argument: 'Account_Name=HELP'

Re: Error in 'fields' command: Invalid argument: 'Account_Name=HELP'

Vijeta — Fri, 12 Apr 2019 16:41:05 GMT

Try this-

 index=win EventCode=528 OR EventCode=4624 LogonType=2 
 | fields Account_Name
 [ | inputlookup identities_1
  | inputlookup append=true identities_2
  | inputlookup append=true identities_3
 |  rename identity as Account_Name
 |  fields Account_Name watchlist
 |  where watchlist = "true" | return $Account_Name   
 ]

Re: Error in 'fields' command: Invalid argument: 'Account_Name=HELP'

splunk_zen — Wed, 17 Apr 2019 14:02:29 GMT

Unfortunately it doesn't work.
Adding $Account_Name yields 0 results

Re: Error in 'fields' command: Invalid argument: 'Account_Name=HELP'

niketn — Wed, 30 Sep 2020 00:12:21 GMT

@splunk_zen, you can try the following, however, I would want to know as to why you have three lookups identities_1, identities_2 and identities_3. I have moved watchlist filter to inputlookup command itself assuming all three lookups have this field.

index=win EventCode=528 OR EventCode=4624 LogonType=2 
    [| inputlookup identities_1 where watchlist = "true" 
    | inputlookup append=true identities_2 where watchlist = "true" 
    | inputlookup append=true identities_3 where watchlist = "true" 
    | rename identity as Account_Name 
    | table Account_Name]

Re: Error in 'fields' command: Invalid argument: 'Account_Name=HELP'

splunk_zen — Fri, 19 Apr 2019 11:31:13 GMT

Issue was really on the dumb first
| fields argument

different lookups are non relevant to this but required as we're using the ldapsearch command to fetch ldapoutputs from several domains