topic Re: Error in 'where' command: The 'in' function is unsupported or undefined. in Splunk Search

Error in 'where' command: The 'in' function is unsupported or undefined.

leonjxtan — Wed, 10 May 2017 05:41:49 GMT

Hi I tried to search as below, with where in(VALUELIST) function as described in: http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions

sourcetype=foo TradeEvent=NEW |where in( TradeID,"value1","value2") |fields TradeID

but I got error as title. could you advise?

Thanks.

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

MuS — Wed, 10 May 2017 05:47:40 GMT

Just to make sure; are you running Splunk 6.6.0?
Because if you are on Splunk cloud (as tagged) the version is Splunk 6.5.1612

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

leonjxtan — Wed, 10 May 2017 05:52:16 GMT

I'm using Splunk Enterprise 6.5.2.
The Splunk-Enterprise tag for some reason is not allowed to use, error: The following topics are not present in the system, and you don't have permissions to create new ones: splunk-enterprise

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

niketn — Wed, 10 May 2017 06:45:32 GMT

@leonjxtan, in seems to be supported only in 6.6 onward...Following is the list of supported evaluation functions for 6.5.2

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/CommonEvalFunctions

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

leonjxtan — Wed, 10 May 2017 06:50:00 GMT

oh ic. thank you.

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

koshyk — Wed, 10 May 2017 08:14:02 GMT

Splunk 6.6.x introuduces IN clause similar to SQL. So if you are on 6.5.2 you won't have it.
https://docs.splunk.com/Documentation/Splunk/6.6.0/ReleaseNotes/MeetSplunk

 New SQL-like IN SPL operator   New SPL operator that acts as a shorthand for multiple disjunctions of one field.   See Comparison and Conditional functions and search in the Search Reference manual.

6.5.2 Where operators: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Where

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

woodcock — Wed, 04 Oct 2017 15:10:06 GMT

We can all celebrate v6.6.1:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/ReleaseNotes/NewSplunkCloudFeatures

Because this:
New SQL-like IN SPL operator New SPL operator that acts as a shorthand for multiple disjunctions of one field. See Comparison and Conditional functions and search in the Search Reference manual.

So this:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/ConditionalFunctions#in.28VALUE-LIST.29

And this:
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions with other commands.
There is also an IN operator that is similar to the in(VALUE-LIST) function that you can use with the search and tstats commands.
The following syntax is supported:
...| where in(field,"value1","value2", ...)
...| where field in("value1","value2", ...)
...| eval new_field=in(field,"value1","value2", ...)