Archive
Highlighted

Question on subsearch as query filter

New Member

Hi guys,

I'm running a query like:
index=myindex [search index=myindex abcd|table x] |table y

This works out well, but in the job details i see the following message multiple times:
INFO StringSearchExpander - calculatedfield="x" not expanded in comparisonexpression="x="blahblah"". calcfieldprocessor!=null, negated=false (negation depth=0)

Can anyone explain what it means and if it impacts the output of my query?

Thanks.

Tags (1)
0 Karma
Highlighted

Re: Question on subsearch as query filter

Champion

I cannot tell you what that message means, but I suggest you try editing the subsearch a little bit and see if the results changes or that message goes away.

index=my_index [search index=my_index abcd|stats count by x | fields x] |table y
0 Karma
Highlighted

Re: Question on subsearch as query filter

Contributor

The best approach for subsearch filter is to use the return function:
|return 100 x -> return one field named "search" with first 100 values in one row, field name included:
"x=value1 OR x=value2 OR x=value3"
|return 100 $x -> return one field named "search" with first 100 values in one row, no field name included:
"value1 OR value2 OR value3"

index=my_index [search index=my_index abcd|table x|return 100 x] |table y

index=my_index [search index=my_index abcd|table x|return 100 $x] |table 
0 Karma