Splunk Search

Error when trying to use a subsearch (Unable to parse the search: Right hand side of IN must be a collection of literals

cyp112
Engager

Hello,

I am trying to use a subsearch on another search but not sure how to format it properly

Subsearch:

eventtype=pan (https://link1.net OR https://link2.net OR https://link3.net)
| rex field=url "LEN_(?<serial>\w+)"
| fillnull value=NULL src_bunit, serial
| fields src_bunit
| dedup src_bunit
| mvcombine src_bunit delim=","
| nomv src_bunit | format

The syntax shown from the format command is:

( src_bunit="A,B,C,D,E,F" ) )

 

On the main search I get this error:

Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals.

The main search

eventtype=dsp_inventory device_control_tags="IMPORTANT*" code IN([subsearch

 

My question is how can a format the subsearch in a way that on the main search it will show results like?:

A,B,C,D,E,F       instead of     src_bunit="A,B,C,D,E,F"    

 

Any ideas? Thank you!

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Replace the 'format' command with

return $src_bunit

that will return A,B,C,D,E,F

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Replace the 'format' command with

return $src_bunit

that will return A,B,C,D,E,F

 

cyp112
Engager

That did it. Thanks a lot. You sir are a God!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...