topic Re: Working with where clause in Splunk Search

Working with where clause

RamMur — Thu, 27 Jun 2024 23:53:13 GMT

Hello,

I'm fairly new to splunk, trying to search using where clause and filter the results. The query is running long, wondering if i'm not doin this right.

a tone down version of the search:

index=provisioning_index cf_org_name=abcd cf_app_name=xyz "ReconCount:" |where jobNumber IN ([search index=provisioning_index cf_org_name=abcd cf_app_name=xyz operation="operation1" status=SUCCESS |search NOT jobType="Canc"|table jobNumber ]) |stats count by deliveryInd | addcoltotals

Re: Working with where clause

richgalloway — Fri, 28 Jun 2024 17:53:29 GMT

The IN operator is not supported by the where command. You can use IN with the search command or the in() function with the where command. In this case, however, the IN is not needed if the subsearch is part of the base search (before the first pipe).

index=provisioning_index cf_org_name=abcd cf_app_name=xyz "ReconCount:" jobNumber [search index=provisioning_index cf_org_name=abcd cf_app_name=xyz operation="operation1" status=SUCCESS |search NOT jobType="Canc"|table jobNumber ] | stats count by deliveryInd | addcoltotals

Re: Working with where clause

RamMur — Fri, 28 Jun 2024 17:29:53 GMT

Afte trying that , it errors out saying

"Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '((jobNumber = "3333") OR (jobNumber = "11111") . OR ..."

Re: Working with where clause

richgalloway — Fri, 28 Jun 2024 17:51:46 GMT

Ah, I should have expected that. Try my revised query without IN.