Why am I unable to search in field?

[karina25]

Hello All,

I have a problem with my search.

The following search works:

index=test_index sourcetype=test_sourcetype 
| search Modulename IN ("Test_One","Test_Two")

 However, this search does not work:

index=test_index sourcetype=test_sourcetype 
| eval helper_modulename = replace("Test_One&form.Modulename=Test_Two", "&form.Modulename=", "\",\"")
| eval helper_modulename = "\"" . helper_modulename . "\""
| search Modulename IN (helper_modulename)

The result of helper_modulename is the same string I use in the search that works:

Can anyone tell me what I am doing wrong and what needs to be adapted to make it work? 🙂

Thank you all in advance!

[karina25]

Thank you so much! This works 🙂

[richgalloway · Accepted solution]

The IN operator expects a list of one or more literals.  It can't handle a field containing a list of literals.  Try using a subsearch to specify the IN values.

index=test_index sourcetype=test_sourcetype
| search Modulename IN ( 
    [| makeresults 
    | eval helper_modulename = replace("Test_One&form.Modulename=Test_Two", "&form.Modulename=", "\",\"") 
    | eval helper_modulename = "\"" . helper_modulename . "\"" 
    | return $helper_modulename])