Splunk Search

Users subsearch in event type not working

arrowecssupport
Communicator

This is my search I am trying to use in an event type so I can tag my events.

index = mail
| eval Subject=coalesce(Subject,subjectx)
| search
Subject = "*NVEM Battery Alert*"

But i get this error? "Message: Eventtype search string cannot be a search pipeline or contain a subsearch"
How would I achieve my search without the subsearch

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

View solution in original post

woodcock
Esteemed Legend

Like this:

index="mail" AND (Subject="*NVEM Battery Alert*" OR subjectx="*NVEM Battery Alert*")

arrowecssupport
Communicator

However, if I want to run multiple searches against lots of subjects, how can I make this more elegant.

0 Karma

arrowecssupport
Communicator

I ended up creating an alias which did the job for me 🙂

0 Karma

woodcock
Esteemed Legend

Use the field IN("value1", "value2", ... , "valueZ") syntax

0 Karma

arjunpkishore5
Motivator

Can you post the whole query ? Or is this it ?

0 Karma

arrowecssupport
Communicator

This is it?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...