Splunk Search

Can't use "Where IN ([subsearch])"

Explorer

Hello,

I'd like to match the result of my main search with a list of values extracted from a CSV.
So at the end of my main search, I appended

| where src IN ([MySubSearch])

It did not work.
But, what is weird, is that the command below did work correctly.

| where src IN (copy/paste of the result of MySubSearch)

If it is helpful, my subsearch is

| inputlookup assets.csv | where category="Groupe_Postes" | eval dns="\"".dns."\""  | stats values(dns) as dns delim="," | nomv dns

And the results is a list of 200 hostnames in the following format :
"PFCC1845","PTADM2364", ....

Thank you in advance for your help
Cheers

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Change your subsearch to this

 | inputlookup assets.csv | where category="Groupe_Postes" | eval dns="\"".dns."\""  | stats values(dns) as search delim="," | nomv search | format "" "" "" "" "" ""

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Change your subsearch to this

 | inputlookup assets.csv | where category="Groupe_Postes" | eval dns="\"".dns."\""  | stats values(dns) as search delim="," | nomv search | format "" "" "" "" "" ""

View solution in original post

0 Karma

Explorer

Thank you for the answer.
When I try it thought, the result of the subsearch becomes :

"\"PFADM0185\",\"PFADM0276\",\"PFADM0290\", ....,\"PTCC0029\",\"ptadm0372\""

I got no error, but the "where" condition does not match.

What I understand though, is that addind "format" at the end of my query displays the way it is really formatting when used in a subsearch, right ?
So I'll try playing with it to have this result at the end (because I know the where condition match this way)

"PFCC1845","PTADM2364", ....
0 Karma

SplunkTrust
SplunkTrust

Give this alternative a try as well

Subsearch:

| inputlookup assets.csv | where category="Groupe_Postes" | stats count by dns | table dns | rename dns as src

Your search:

...| where [result from subsearch]

Explorer

This time it works ! Thank you very much !

0 Karma