Splunk Search

Users subsearch in event type not working

arrowecssupport
Communicator

This is my search I am trying to use in an event type so I can tag my events.

index = mail
| eval Subject=coalesce(Subject,subjectx)
| search
Subject = "*NVEM Battery Alert*"

But i get this error? "Message: Eventtype search string cannot be a search pipeline or contain a subsearch"
How would I achieve my search without the subsearch

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

View solution in original post

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

View solution in original post

arrowecssupport
Communicator

However, if I want to run multiple searches against lots of subjects, how can I make this more elegant.

0 Karma

arrowecssupport
Communicator

I ended up creating an alias which did the job for me 🙂

0 Karma

woodcock
Esteemed Legend

Use the field IN("value1", "value2", ... , "valueZ") syntax

0 Karma

arjunpkishore5
Motivator

Can you post the whole query ? Or is this it ?

0 Karma

arrowecssupport
Communicator

This is it?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!