Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side: (FNN = "A0291234567").

[goken]

Hi all,

Below is my search command:

| inputlookup servicereport.csv
| search "FNN" = [ | inputlookup extract.csv
| search bbsubscriber="broadband@userid.com"
| eval bbfnn = "A" + bbfnn | rename "bbfnn" as FNN
| fields FNN | dedup FNN | rex field=search mode=sed "s/FNN=//g" ]

I am receiving below error:

Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side: (FNN = "A0291234567").

Please help, thank you in advance

[niketn · Accepted solution]

@goken try the following and confirm.

| inputlookup servicereport.csv 
| search "FNN" = [ | inputlookup extract.csv
| search bbsubscriber="broadband@userid.com"
| eval bbfnn = "A" + bbfnn | rename "bbfnn" as FNN
| fields FNN | dedup FNN | rex field=search mode=sed "s/FNN=//g" 
| rename FNN as search]

While above would work based on the query you have provided, I did not get the intent of rex command. So while posting your question in order for the community to assist you better do post more context around your use case and some sample data with expected output. Do mock/anonymize any sensitive information before posting the same on Splunk Answers. Another thing I did not grasp was whether you want to perform multiple OR kind of search or IN () if the subsearch returned multiple values. Besides above your query would also use where with inputlookup to filter required results from lookup. Instead of getting all the data from lookup and then filtering afterwards.

[smitharani]

@niketn 

Hi, I am doing a Splunk Query and came across a similar issue and hence posting here. Hope you can help! 

My main search has 2 subsearches. Inner most subsearch returns all the orderIds for an email address. Each orderid is passed to the next subsearch which gives a refundid for this orderid. Note that not all orderid has a refundid. The main search takes the refundid and returns the other details such as refundreason, resultcode, resultmessage. Can you please help with this query? Goal is to use  this in a dashboard. User enters email as an inputfield. The refund details will be displayed in a table for all orderids associated to this email. Individual subsearches are working. But when put together, I get an error.

index=*prod* source="http:smartrefund_prod" data.RefundId=
[search index=*prod* source="http:smartrefund_prod" data.OrderGUID=

[search index=*prod* sourcetype=ordersv2  CustomerEmail="tester@testy.com" |table OrderId] | data.SmartRefundRecord.id != null|table data.SmartRefundRecord.id]

| table data.RefundId data.RefundReasons{} data.ResultCode data.ResultMessage