Splunk Search

Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals?

buttsurfer
Path Finder

 

index=index1 type=1 feature IN ([search index=index1 type=type2 application=weather_app
    | dedup feature
    | fields feature
    | format
    ])

 

 

The above code returns this error and i cant seem to figure out how to fix it. Any help would be appreciated

Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '((feature = "feature1") OR (feature = "feature2") OR (feature = "feature3") OR (feature = "feature4") is not a literal.

Labels (2)
0 Karma
1 Solution

buttsurfer
Path Finder

Fixed it by adding 

 

          | dedup feature
          | fields feature
          | format "" "" "" "" "," ""
          | eval search=replace (search, "feature=", "")

 

View solution in original post

0 Karma

buttsurfer
Path Finder

Fixed it by adding 

 

          | dedup feature
          | fields feature
          | format "" "" "" "" "," ""
          | eval search=replace (search, "feature=", "")

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @buttsurfer,

you can also use this easier solution:

index=index1 type=1 [search index=index1 type=type2 application=weather_app | rename feature AS query | fields query ]
| ...

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...