A nested search comparison must use compatible data types. A User attribute holds user-name/text values, whereas Device IP holds IP-address values; comparing them with IN cannot produce matching events. IBM QRadar reference-data guidance likewise distinguishes user-name and IP-address values as separate property types for comparisons.
Community Discussion