Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals?

[buttsurfer]

index=index1 type=1 feature IN ([search index=index1 type=type2 application=weather_app
    | dedup feature
    | fields feature
    | format
    ])

The above code returns this error and i cant seem to figure out how to fix it. Any help would be appreciated

Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '((feature = "feature1") OR (feature = "feature2") OR (feature = "feature3") OR (feature = "feature4") is not a literal.

[buttsurfer · Accepted solution]

Fixed it by adding 

          | dedup feature
          | fields feature
          | format "" "" "" "" "," ""
          | eval search=replace (search, "feature=", "")

[gcusello]

Hi @buttsurfer,

you can also use this easier solution:

index=index1 type=1 [search index=index1 type=type2 application=weather_app | rename feature AS query | fields query ]
| ...

Ciao.

Giuseppe