topic Re: Users subsearch in event type not working in Splunk Search

Users subsearch in event type not working

arrowecssupport — Fri, 29 Nov 2019 16:55:55 GMT

This is my search I am trying to use in an event type so I can tag my events.

index = mail
| eval Subject=coalesce(Subject,subjectx)
| search
Subject = "*NVEM Battery Alert*"

But i get this error? "Message: Eventtype search string cannot be a search pipeline or contain a subsearch"
How would I achieve my search without the subsearch

Re: Users subsearch in event type not working

arjunpkishore5 — Fri, 29 Nov 2019 18:16:24 GMT

Can you post the whole query ? Or is this it ?

Re: Users subsearch in event type not working

woodcock — Fri, 29 Nov 2019 19:13:58 GMT

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

Re: Users subsearch in event type not working

arrowecssupport — Wed, 04 Dec 2019 09:05:15 GMT

This is it?

Re: Users subsearch in event type not working

arrowecssupport — Wed, 04 Dec 2019 09:06:58 GMT

However, if I want to run multiple searches against lots of subjects, how can I make this more elegant.

Re: Users subsearch in event type not working

woodcock — Wed, 04 Dec 2019 10:46:11 GMT

Use the field IN("value1", "value2", ... , "valueZ") syntax

Re: Users subsearch in event type not working

arrowecssupport — Fri, 06 Dec 2019 12:37:03 GMT

I ended up creating an alias which did the job for me 🙂