Hello, I have the following issue, do you know any solution or workaround? (Or maybe I declared something wrongly...) When using a comma separated field values in MAP within the IN command, it is ...
See more...
Hello, I have the following issue, do you know any solution or workaround? (Or maybe I declared something wrongly...) When using a comma separated field values in MAP within the IN command, it is not working from the outer search. But when I write out the value of that outside field, it is recognized. | makeresults
| eval ips="a,c,x"
| map [
| makeresults
| append [ makeresults | eval ips="a", label="aaa" ]
| append [ makeresults | eval ips="b", label="bbb" ]
| append [ makeresults | eval ips="c", label="ccc" ]
| append [ makeresults | eval ips="d", label="ddd" ]
```| search ips IN ($ips$)``` ```NOT WORKING```
| search ips IN (a,c,x) ```WORKING```
| eval outer_ips=$ips$
] maxsearches=10