Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug] Negative subquery used #3282

Open
stevengoossensB opened this issue Nov 21, 2023 · 1 comment
Open

[Bug] Negative subquery used #3282

stevengoossensB opened this issue Nov 21, 2023 · 1 comment
Labels
backlog bug Something isn't working community

Comments

@stevengoossensB
Copy link

Describe the bug
EQL constructed in the below manner is failing validation with error message Negative subquery used :
.

sequence by xxxxx with maxspan=15m
![subquery1]
[subquery2]

However, this should be legit EQL and we should be able to pass validation.
@stevengoossensB stevengoossensB added the bug Something isn't working label Nov 21, 2023
@Mikaayenson
Copy link
Contributor

@stevengoossensB you are correct. It was added in 8.9.0. Can you provide an example TOML and/or confirm you're minstacked at 8.9?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
backlog bug Something isn't working community
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@Mikaayenson @stevengoossensB