Archive
Highlighted

Error in 'where' command: The 'in' function is unsupported or undefined.

Path Finder

Hi I tried to search as below, with where in(VALUELIST) function as described in: http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/ConditionalFunctions

sourcetype=foo TradeEvent=NEW |where in( TradeID,"value1","value2") |fields TradeID

but I got error as title. could you advise?

Thanks.

Tags (1)
0 Karma
Highlighted

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

SplunkTrust
SplunkTrust

Just to make sure; are you running Splunk 6.6.0?
Because if you are on Splunk cloud (as tagged) the version is Splunk 6.5.1612

0 Karma
Highlighted

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

Path Finder

I'm using Splunk Enterprise 6.5.2.
The Splunk-Enterprise tag for some reason is not allowed to use, error: The following topics are not present in the system, and you don't have permissions to create new ones: splunk-enterprise

0 Karma
Highlighted

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

Legend

@leonjxtan, in seems to be supported only in 6.6 onward...Following is the list of supported evaluation functions for 6.5.2

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/CommonEvalFunctions




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

Path Finder

oh ic. thank you.

0 Karma
Highlighted

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

Super Champion

Splunk 6.6.x introuduces IN clause similar to SQL. So if you are on 6.5.2 you won't have it.
https://docs.splunk.com/Documentation/Splunk/6.6.0/ReleaseNotes/MeetSplunk

 New SQL-like IN SPL operator   New SPL operator that acts as a shorthand for multiple disjunctions of one field.   See Comparison and Conditional functions and search in the Search Reference manual.

6.5.2 Where operators: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Where

View solution in original post

0 Karma
Highlighted

Re: Error in 'where' command: The 'in' function is unsupported or undefined.

Esteemed Legend

We can all celebrate v6.6.1:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/ReleaseNotes/NewSplunkCloudFeatures

Because this:
New SQL-like IN SPL operator New SPL operator that acts as a shorthand for multiple disjunctions of one field. See Comparison and Conditional functions and search in the Search Reference manual.

So this:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/ConditionalFunctions#in.28VAL...

And this:
You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions with other commands.
There is also an IN operator that is similar to the in(VALUE-LIST) function that you can use with the search and tstats commands.
The following syntax is supported:
...| where in(field,"value1","value2", ...)
...| where field in("value1","value2", ...)
...| eval new_field=in(field,"value1","value2", ...)

0 Karma