Error Message About Literals

genesiusj — Thu, 24 Oct 2019 14:28:06 GMT

Hello,
One of my biggest pet peeves about software is the lack of information around error messages. Obviously, a developer wrote the error code and its associated message. However, most software has a vast black hole around such messages.

Case is point.
"Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '(localrefid = "WW201929400001699")' is not a literal."

If I Google this error "Unable to parse the search: Right hand side of IN must be a collection of literals. ", I receive ONE hit.
link text

Searching this page for literal leads to
link text

Which in turn leads to NOWHERE, none of the links work.

Here is my code.

index="test"
    AND priority="INFO"
    AND ("STARTED" OR "FINISHED") 
    AND (localrefid IN 
    [ search index="test"
        AND priority="INFO"
        AND (localrefid!="12345" AND localrefid!="null" OR localrefid!="")
        AND ("STARTED" OR "FINISHED") 
    | dedup localrefid 
    | table localrefid ]
    OR token IN
    [ search index="test"
        AND priority="INFO"
        AND localrefid!="12345"
        AND (token!="null" AND token!="")
        AND ("STARTED" OR "FINISHED") 
    | dedup token 
    | table token ] ) 
| dedup _raw
| rex field=_raw "(FINISHED|STARTED\s)\:\s(?<transMethod>\w*)\s" 
| rex field=_raw "Total Time\s(?<methodTime>\d*\.?\d*)\sseconds" 
| eval methodTime=round(methodTime,3) 
| transaction localrefid, token
| sort +_time, localrefid, token 
| table _time, appName, transMethod, localrefid, token, eventcount, methodTime, _raw

Thanks in advance for your assistance with this undocumented error (at least in my search of the Internet), and for dealing with my pet peeve. 🙂

God bless,
Genesius

Re: Error Message About Literals

richgalloway — Thu, 24 Oct 2019 14:46:53 GMT

IN requires a comma-separated list of field names, numbers, or strings. Run the subsearches alone and you'll find they are not returning such output. Creative use of the format command may be able to remedy that.

topic Re: Error Message About Literals in Splunk Search

Error Message About Literals

Re: Error Message About Literals