You need this:
index=indexName | where 'Error.Type' IN ("ServConfigError", "GetCompFail")
index=indexName | search 'Error.Type' IN (ServConfigError, GetCompFail)
The reason you are confused is because where assumes that the Right-Side-Value is a field name , unless this is unlikely or impossible, such as when the RHS is a digit (which is an "unlean" field name), when it will be treated as a string-literal , whereas search always expects a string-literal . In any case, it is a good best-practice to always enclose string-literals inside double-quotes, especially those which are RSVs .
... View more