Splunk Search

Users subsearch in event type not working

arrowecssupport
Communicator

This is my search I am trying to use in an event type so I can tag my events.

index = mail
| eval Subject=coalesce(Subject,subjectx)
| search
Subject = "*NVEM Battery Alert*"

But i get this error? "Message: Eventtype search string cannot be a search pipeline or contain a subsearch"
How would I achieve my search without the subsearch

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

View solution in original post

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

arrowecssupport
Communicator

However, if I want to run multiple searches against lots of subjects, how can I make this more elegant.

0 Karma

arrowecssupport
Communicator

I ended up creating an alias which did the job for me 🙂

0 Karma

woodcock
Esteemed Legend

Use the field IN("value1", "value2", ... , "valueZ") syntax

0 Karma

arjunpkishore5
Motivator

Can you post the whole query ? Or is this it ?

0 Karma

arrowecssupport
Communicator

This is it?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...