Splunk Search
Highlighted

Why using 'in' in a search doesn't yield correct results?

Explorer
index="things" AND sourcetype="user_pixel" AND os="*" | search page = "Contact Us" | timechart span=3hr count by os limit=7

Vs

index="things" AND sourcetype="user_pixel" AND os="*" | search page in ("Contact Us") | timechart span=3hr count by os limit=7

The first search gives many results as expected, the second gives nothing.

My ultimate goal is to use a dashboard multi-select to apply this filter. However; first I need to get the "in" function to work correctly. What am I doing wrong?

0 Karma
Highlighted

Re: Why using 'in' in a search doesn't yield correct results?

Ultra Champion

Your use of ‘in’ is incorrect

It should be in(page, “Contact Us”,”some other page”)

However, ‘in’ evaluates to true/false, so you can’t use it with search, it’s an evaluation function.

|eval result=in(page, “Contact Us”,”some other page”)

Then you can do:
|where result=true

View solution in original post

Highlighted

Re: Why using 'in' in a search doesn't yield correct results?

Contributor

IN should be in caps, and you should not need the "| search" in there.

 index="things" AND sourcetype="user_pixel" AND os="*" page IN ("Contact Us") | timechart span=3hr count by os limit=7

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Search#Multiplefield-valuecomparisonswiththeINoperator

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.