Using ITSI on Splunk Cloud.
Using the following search to create a correlation search
| eval MatchPattern =
[| inputlookup test.csv
| eval PatternToSearch="\"%".Error."%\""
| eval commandToExecute="message LIKE ".PatternToSearch.",\"".Message."\""
| fields commandToExecute
| stats delim="," values(commandToExecute) as commandToExecute
| mvcombine commandToExecute
| eval commandToExecute="case(".commandToExecute.",1=1,\"UnMatched\")"
| return $commandToExecute]
| fillnull MatchPattern value="Null"
| search MatchPattern!= "UnMatched"
"Invalid search string: This search cannot be parsed when parse_only is set to true."
You can't use a sub-search returning into an eval in a correlation search. As a workaround:
1. Create and save a basic correlation search with all of the information you want outside of the search.
2. As an admin user, go to Settings > Searches, reports, and alerts and open the correlation search you just created.
3. Add the sub-search you were trying to add there.
This workaround is also documented in known issue ITSI-3322 in the release notes.