Splunk Search

Users subsearch in event type not working

arrowecssupport
Communicator

This is my search I am trying to use in an event type so I can tag my events.

index = mail
| eval Subject=coalesce(Subject,subjectx)
| search
Subject = "*NVEM Battery Alert*"

But i get this error? "Message: Eventtype search string cannot be a search pipeline or contain a subsearch"
How would I achieve my search without the subsearch

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

View solution in original post

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

arrowecssupport
Communicator

However, if I want to run multiple searches against lots of subjects, how can I make this more elegant.

0 Karma

arrowecssupport
Communicator

I ended up creating an alias which did the job for me 🙂

0 Karma

woodcock
Esteemed Legend

Use the field IN("value1", "value2", ... , "valueZ") syntax

0 Karma

arjunpkishore5
Motivator

Can you post the whole query ? Or is this it ?

0 Karma

arrowecssupport
Communicator

This is it?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...