topic Re: Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. in Splunk Search

Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals?

buttsurfer — Mon, 13 Feb 2023 17:10:04 GMT

index=index1 type=1 feature IN ([search index=index1 type=type2 application=weather_app | dedup feature | fields feature | format ])

The above code returns this error and i cant seem to figure out how to fix it. Any help would be appreciated

Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '((feature = "feature1") OR (feature = "feature2") OR (feature = "feature3") OR (feature = "feature4") is not a literal.

Re: Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals.

buttsurfer — Mon, 13 Feb 2023 06:28:21 GMT

Fixed it by adding

| dedup feature | fields feature | format "" "" "" "" "," "" | eval search=replace (search, "feature=", "")

Re: Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals.

gcusello — Mon, 13 Feb 2023 07:17:20 GMT

Hi @buttsurfer,

you can also use this easier solution:

index=index1 type=1 [search index=index1 type=type2 application=weather_app | rename feature AS query | fields query ] | ...

Ciao.

Giuseppe