Subsearch does not work

[simuvid]

What is wrong with following search:

sourcetype="security" ip=[search sourcetype=access_combined status=401 clientip=* | transaction fields clientip | where eventcount>2 | stats count, values(clientip) by status]

What I get is following message:

Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side.

Any hints?

Cheers

simuvid

[ziegfried · Accepted solution]

A subsearch is used this way:

sourcetype="security" [ search sourcetype=access_combined status=401 clientip=* | transaction fields clientip | where eventcount>2 | fields clientip | dedup clientip | rename clientip as ip ]

The subsearch should return a result like this

|    ip     |
| --------- |
| 10.1.1.1  |
| 10.1.1.2  |
| 10.1.1.3  |

Which will expanded to the following condition:

( ( ip="10.1.1.1") OR (ip="10.1.1.2") OR (ip="10.1.1.3") )

You can inspect the conditions generated by the subsearch by executing:

sourcetype=access_combined status=401 clientip=* | transaction fields clientip | where eventcount>2 | fields clientip | dedup clientip | rename clientip as ip | format

[simuvid]

Thanks!!!

That one works as expected!

Cheers,

simuvid