Hello all,
I am trying to run the below query and when I change the earliest to last 7 days I am getting the below error. However, it is running fine if I add -30d for earliest search.
`acn_patchmanagement_macro_serverdetails_t1_001`
|where NOT IN (Server,[|search earliest=-7d latest=now() `acn_patchmanagement_macro_serverdetails_t1_001` |stats count(Server) by Server|table Server])
|lookup acn_patchmanagement_lookup_server-details_001 Server OUTPUT OS_Type OS_SubType
| eval OS_Type=if(isnull(OS_Type), "NA", OS_Type)
| eval OS_SubType=if(isnull(OS_SubType), "NA", OS_SubType)
|append [| inputlookup acn_patchmanagement_lookup_server-details_001.csv ]
|fields Last_Patched_Date ChangeNo Server OS_Type OS_SubType Overall_Status
Below is the error:
Error in 'where' command: The expression is malformed. An unexpected character is reached at ') ) '.
Please let me know the solution for this.
yes, make sense
Try this
|search NOT (Server,[|search earliest=-7d latest=now() `acn_patchmanagement_macro_serverdetails_t1_001` |stats count(Server) by Server|table Server])
Try return $Server at the end of the subsearch
try to change where with search
|search NOT IN (Server,[|search earliest=-7d latest=now()
Hello, Thank you for your response.
I tried and now facing the issue with the NOT IN. Below is the error.
Error in 'search' command: Unable to parse the search: Comparator 'IN' has an invalid term on the left hand side: NOT.
yes, make sense
Try this
|search NOT (Server,[|search earliest=-7d latest=now() `acn_patchmanagement_macro_serverdetails_t1_001` |stats count(Server) by Server|table Server])
This worked. Thank you.