topic Re: How can I pass dynamic values to the IN operator? in Splunk Search

How can I pass dynamic values to the IN operator?

yk010123 — Mon, 14 Feb 2022 21:02:35 GMT

I tried this :

.... myField IN (
[search ..| table myField])

Where the values passed to the IN operator will be calculate dynamically from another search

But that returns

Unable to parse the search: Right hand side of IN must be a collection of literals. '((myField = "123") OR (myField = "1234")

How can I do this?

Re: How can I pass dynamic values to the IN operator?

richgalloway — Tue, 15 Feb 2022 01:27:04 GMT

Subsearches aren't designed to work with the IN operator since IN is relatively new. We can make it work, however. Try this

... myField IN ( [ search ... ```We only need one field``` | fields myField ```Remove duplicate values``` | dedup myField ```Format the results using no delimeters``` | format mvsep="" "" "" "" "" "" "" ```Remove "myField=" from the formatted string``` | eval search=replace(search, "myField =", "") ]

Re: How can I pass dynamic values to the IN operator?

ITWhisperer — Tue, 15 Feb 2022 07:09:55 GMT

This can be slightly simplified by renaming myField to query in the subsearch because the format command treats this as a special case and doesn't include the "query=" in the formatted string

... myField IN ( [ search ... ```We only need one field``` | fields myField ```Remove duplicate values``` | dedup myField ``` rename field to query | rename myField as query ```Format the results using no delimeters``` | format mvsep="" "" "" "" "" "" "" ] )

Re: How can I pass dynamic values to the IN operator?

VatsalJagani — Wed, 16 Feb 2022 06:16:29 GMT

Or you can simplify to this in most cases:

<your-search> [search <the search you wish to write> | table myField]

- As far as field name myField is common in both searches.

- Splunk will automatically add the IN operator.

Re: How can I pass dynamic values to the IN operator?

richgalloway — Wed, 16 Feb 2022 12:54:12 GMT

@VatsalJagani wrote:
- Splunk will automatically add the IN operator.

Not exactly. Splunk will automatically convert the subsearch into a series of OR clauses, which is the same thing it does with the IN operator.

Re: How can I pass dynamic values to the IN operator?

VatsalJagani — Wed, 16 Feb 2022 16:11:33 GMT

Yeah, that is correct both will be converted to OR operators but those are one or the same thing. So to avoid confusion I generally say IN operator.

But thanks for clarification.

Re: How can I pass dynamic values to the IN operator?

lmonahan — Sat, 04 Nov 2023 12:50:07 GMT

Incredible answer!

Re: How can I pass dynamic values to the IN operator?

lmonahan — Sat, 04 Nov 2023 12:50:27 GMT

Another incredible answer! These helped me a lot!