Splunk Search

Users subsearch in event type not working

arrowecssupport
Communicator

This is my search I am trying to use in an event type so I can tag my events.

index = mail
| eval Subject=coalesce(Subject,subjectx)
| search
Subject = "*NVEM Battery Alert*"

But i get this error? "Message: Eventtype search string cannot be a search pipeline or contain a subsearch"
How would I achieve my search without the subsearch

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

View solution in original post

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

arrowecssupport
Communicator

However, if I want to run multiple searches against lots of subjects, how can I make this more elegant.

0 Karma

arrowecssupport
Communicator

I ended up creating an alias which did the job for me 🙂

0 Karma

woodcock
Esteemed Legend

Use the field IN("value1", "value2", ... , "valueZ") syntax

0 Karma

arjunpkishore5
Motivator

Can you post the whole query ? Or is this it ?

0 Karma

arrowecssupport
Communicator

This is it?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...