index=index1 type=1 feature IN ([search index=index1 type=type2 application=weather_app
| dedup feature
| fields feature
| format
])
The above code returns this error and i cant seem to figure out how to fix it. Any help would be appreciated
Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '((feature = "feature1") OR (feature = "feature2") OR (feature = "feature3") OR (feature = "feature4") is not a literal.
Fixed it by adding
| dedup feature
| fields feature
| format "" "" "" "" "," ""
| eval search=replace (search, "feature=", "")
Fixed it by adding
| dedup feature
| fields feature
| format "" "" "" "" "," ""
| eval search=replace (search, "feature=", "")
Hi @buttsurfer,
you can also use this easier solution:
index=index1 type=1 [search index=index1 type=type2 application=weather_app | rename feature AS query | fields query ]
| ...
Ciao.
Giuseppe