Hello All,
I have a problem with my search.
The following search works:
index=test_index sourcetype=test_sourcetype
| search Modulename IN ("Test_One","Test_Two")
However, this search does not work:
index=test_index sourcetype=test_sourcetype
| eval helper_modulename = replace("Test_One&form.Modulename=Test_Two", "&form.Modulename=", "\",\"")
| eval helper_modulename = "\"" . helper_modulename . "\""
| search Modulename IN (helper_modulename)
The result of helper_modulename is the same string I use in the search that works:
Can anyone tell me what I am doing wrong and what needs to be adapted to make it work? 🙂
Thank you all in advance!
The IN operator expects a list of one or more literals. It can't handle a field containing a list of literals. Try using a subsearch to specify the IN values.
index=test_index sourcetype=test_sourcetype
| search Modulename IN (
[| makeresults
| eval helper_modulename = replace("Test_One&form.Modulename=Test_Two", "&form.Modulename=", "\",\"")
| eval helper_modulename = "\"" . helper_modulename . "\""
| return $helper_modulename])
Thank you so much! This works 🙂
The IN operator expects a list of one or more literals. It can't handle a field containing a list of literals. Try using a subsearch to specify the IN values.
index=test_index sourcetype=test_sourcetype
| search Modulename IN (
[| makeresults
| eval helper_modulename = replace("Test_One&form.Modulename=Test_Two", "&form.Modulename=", "\",\"")
| eval helper_modulename = "\"" . helper_modulename . "\""
| return $helper_modulename])