Users subsearch in event type not working

[arrowecssupport]

This is my search I am trying to use in an event type so I can tag my events.

index = mail
| eval Subject=coalesce(Subject,subjectx)
| search
Subject = "*NVEM Battery Alert*"

But i get this error? "Message: Eventtype search string cannot be a search pipeline or contain a subsearch"
How would I achieve my search without the subsearch

[woodcock · Accepted solution]

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

[arrowecssupport]

However, if I want to run multiple searches against lots of subjects, how can I make this more elegant.

[arrowecssupport]

I ended up creating an alias which did the job for me 🙂

[woodcock]

Use the field IN("value1", "value2", ... , "valueZ") syntax

[arjunpkishore5]

Can you post the whole query ? Or is this it ?

[arrowecssupport]

This is it?