Splunk Search

Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side: (FNN = "A0291234567").

goken
New Member

Hi all,

Below is my search command:

| inputlookup servicereport.csv
| search "FNN" = [ | inputlookup extract.csv
| search bbsubscriber="broadband@userid.com"
| eval bbfnn = "A" + bbfnn | rename "bbfnn" as FNN
| fields FNN | dedup FNN | rex field=search mode=sed "s/FNN=//g" ]

I am receiving below error:

Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side: (FNN = "A0291234567").

Please help, thank you in advance

Tags (1)
0 Karma
1 Solution

niketnilay
Legend

@goken try the following and confirm.

| inputlookup servicereport.csv 
| search "FNN" = [ | inputlookup extract.csv
| search bbsubscriber="broadband@userid.com"
| eval bbfnn = "A" + bbfnn | rename "bbfnn" as FNN
| fields FNN | dedup FNN | rex field=search mode=sed "s/FNN=//g" 
| rename FNN as search]

While above would work based on the query you have provided, I did not get the intent of rex command. So while posting your question in order for the community to assist you better do post more context around your use case and some sample data with expected output. Do mock/anonymize any sensitive information before posting the same on Splunk Answers. Another thing I did not grasp was whether you want to perform multiple OR kind of search or IN () if the subsearch returned multiple values. Besides above your query would also use where with inputlookup to filter required results from lookup. Instead of getting all the data from lookup and then filtering afterwards.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketnilay
Legend

@goken try the following and confirm.

| inputlookup servicereport.csv 
| search "FNN" = [ | inputlookup extract.csv
| search bbsubscriber="broadband@userid.com"
| eval bbfnn = "A" + bbfnn | rename "bbfnn" as FNN
| fields FNN | dedup FNN | rex field=search mode=sed "s/FNN=//g" 
| rename FNN as search]

While above would work based on the query you have provided, I did not get the intent of rex command. So while posting your question in order for the community to assist you better do post more context around your use case and some sample data with expected output. Do mock/anonymize any sensitive information before posting the same on Splunk Answers. Another thing I did not grasp was whether you want to perform multiple OR kind of search or IN () if the subsearch returned multiple values. Besides above your query would also use where with inputlookup to filter required results from lookup. Instead of getting all the data from lookup and then filtering afterwards.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

smitharani
New Member

@niketnilay 

Hi, I am doing a Splunk Query and came across a similar issue and hence posting here. Hope you can help! 

My main search has 2 subsearches. Inner most subsearch returns all the orderIds for an email address. Each orderid is passed to the next subsearch which gives a refundid for this orderid. Note that not all orderid has a refundid. The main search takes the refundid and returns the other details such as refundreason, resultcode, resultmessage. Can you please help with this query? Goal is to use  this in a dashboard. User enters email as an inputfield. The refund details will be displayed in a table for all orderids associated to this email. Individual subsearches are working. But when put together, I get an error.

index=*prod* source="http:smartrefund_prod" data.RefundId=
[search index=*prod* source="http:smartrefund_prod" data.OrderGUID=

[search index=*prod* sourcetype=ordersv2  CustomerEmail="tester@testy.com" |table OrderId] | data.SmartRefundRecord.id != null|table data.SmartRefundRecord.id]

| table data.RefundId data.RefundReasons{} data.ResultCode data.ResultMessage

 

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...