Developing for Splunk Enterprise

use IN command with subsearch


i want to use IN command with subsearch like in the query above:

| tstats summariesonly=true allow_old_summaries=true max(_time) as _time, values("events.eventtype") as eventtype FROM datamodel=events_prod WHERE "events.kafka_uuid" IN ("search= [ | inputlookup kv_alerts_prod where _key="5f" | table uuids]") BY "events.kafka_uuid", "events.tail_id", "events._indextime", "events._raw", source, sourcetype

this query returns no results.. what am i missing ? 

Labels (1)
Tags (2)
0 Karma


Check the search log to see how Splunk is parsing that query.  I suspect the contents of the IN argument is being treated literally instead of as a subsearch.

If the subsearch is being processed then it's possible it's not returning a valid argument for IN.  Run the subsearch by itself with | format on the end to see the exact string returned.  Adjust the subsearch as needed to make the returned value a valid IN argument.

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!