Splunk Search

'where propertyname In (propertyvalue1, propertyvalue2, etc...)' int vs string values

gabenav11
Explorer

Hello, I am having difficulty using the 'where property in (x,y,z,...)' type search filter in Splunk. Specifically, when the property values are strings.

This works for me:

     index=indexName | where 'Error.Code' in (5224, 5198)

But this does not:

index=indexName | where 'Error.Type' in (ServConfigError,GetCompFail)

Any idea why that would be? I've tried a lot of combinations of quotes, single and double, around different things, and also trying this kind of construction:

index=indexName 'Error.Type' in (ServConfigError,GetCompFail)

and this

index=indexName | where in ('Error.Type', ServConfigError,GetCompFail)

and so on, and I can't get it to work

thanks for any help

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Have the string values in double quoutes. See supported format in the Splunk documentation here:

https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/ConditionalFunctions#in.28FIELD.2...

View solution in original post

0 Karma

woodcock
Esteemed Legend

You need this:

 index=indexName | where 'Error.Type' IN ("ServConfigError", "GetCompFail")
 index=indexName | search 'Error.Type' IN (ServConfigError, GetCompFail)

The reason you are confused is because where assumes that the Right-Side-Value is a field name, unless this is unlikely or impossible, such as when the RHS is a digit (which is an "unlean" field name), when it will be treated as a string-literal, whereas search always expects a string-literal. In any case, it is a good best-practice to always enclosestring-literals inside double-quotes, especially those which are RSVs.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Have the string values in double quoutes. See supported format in the Splunk documentation here:

https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/ConditionalFunctions#in.28FIELD.2...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...