Developing for Splunk Enterprise

use IN command with subsearch


i want to use IN command with subsearch like in the query above:

| tstats summariesonly=true allow_old_summaries=true max(_time) as _time, values("events.eventtype") as eventtype FROM datamodel=events_prod WHERE "events.kafka_uuid" IN ("search= [ | inputlookup kv_alerts_prod where _key="5f" | table uuids]") BY "events.kafka_uuid", "events.tail_id", "events._indextime", "events._raw", source, sourcetype

this query returns no results.. what am i missing ? 

Labels (1)
Tags (2)
0 Karma


Check the search log to see how Splunk is parsing that query.  I suspect the contents of the IN argument is being treated literally instead of as a subsearch.

If the subsearch is being processed then it's possible it's not returning a valid argument for IN.  Run the subsearch by itself with | format on the end to see the exact string returned.  Adjust the subsearch as needed to make the returned value a valid IN argument.

If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!