@michaelrosello I've tried with your configuration but unable to reproduce this error. Your configurations looks proper. Can you please try to create new EventType with the same configuration? Just minor correction keep blank between
First, check the
index= and get rid of the space in it.
Second, it is possible that an unprintable/invisible character was put into the definition by cut-and-paste. This happens extremely often and is the hardest thing to identify. The solution is to retype the list manually, and see if that helps.
Third, if that didn't fix it, try each of the below with an IN clause that has only three items until you know the proper syntax is working.
IN (20,30,50) IN (20, 30, 50) IN (20 30 50) IN ("20","30","50") IN ("20", "30", "50") IN ("20" "30" "50")
All of the above should work, so we're trying to determine if there are additional undocumented limits when used in this manner.
Finally, if none of the above results in a working definition, check btool and see if you have a conflicting eventtype definition.
Hmm I tried typing it manual IN(20, 30).
weirdly enough when I search index=myindex eventtype=AIOPSCOEREPORT I still get the same error.
But when I search for just the index. i can see an eventtpe in my interesting field with the correct eventtype value which is the AIOPSCOEREPORT
I also tried clicking it to add it to search, then I get again the same error.