Working with where clause

[RamMur]

Hello, 

I'm fairly new to splunk, trying to search using where clause and filter the results. The query is running long, wondering if i'm not doin this right.

a tone down version of the search:

index=provisioning_index cf_org_name=abcd cf_app_name=xyz "ReconCount:"
|where jobNumber IN ([search index=provisioning_index cf_org_name=abcd cf_app_name=xyz operation="operation1" status=SUCCESS
|search NOT jobType="Canc"|table jobNumber
])
|stats count by deliveryInd
| addcoltotals

[RamMur]

Afte trying that , it errors out saying 

"Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '((jobNumber = "3333") OR (jobNumber = "11111") . OR ..."

[richgalloway · Accepted solution]

Ah, I should have expected that.  Try my revised query without IN.

[richgalloway]

The IN operator is not supported by the where command.  You can use IN with the search command or the in() function with the where command.  In this case, however, the IN is not needed if the subsearch is part of the base search (before the first pipe).

index=provisioning_index cf_org_name=abcd cf_app_name=xyz "ReconCount:"
jobNumber [search index=provisioning_index cf_org_name=abcd cf_app_name=xyz operation="operation1" status=SUCCESS
  |search NOT jobType="Canc"|table jobNumber
  ]
| stats count by deliveryInd
| addcoltotals