Archive
Highlighted

Using a subsearch with inputlookup to filter results returns errors

Path Finder

Hi guys,

Im trying to filter a list of messages coming from my index by checking the sender for membership in a group. I have defined the group in a csv file that contains the emails of each user which i can successfully query using inputlookup, the issue arrives when i wrap that search up as a subsearch and use it as a check in my where command:

index="MessageIndex"
    | where isnotnull([
    | inputlookup ListOfEmails.csv 
    | search mail=$MessageSender$ 
    | rename mail as query 
    | fields query
    | head 1])
| table *

This returns the error:

Error in 'where' command: The expression is malformed. An unexpected character is reached at ') ) '.

I have tried passing the subsearch to an Eval command but i get the same error minus one ')' even though there isn't a ')' in sight. Any ideas?

Tags (1)
0 Karma
Highlighted

Re: Using a subsearch with inputlookup to filter results returns errors

Motivator

Try this:

index="MessageIndex"
[| inputlookup ListOfEmails.csv
| search mail=$MessageSender$
| rename mail as query
| fields query
| head 1]

0 Karma
Highlighted

Re: Using a subsearch with inputlookup to filter results returns errors

Path Finder

Thanks, that gets rid of the error!

The only issue now is that i'm not sure it is only allowing events where the messagesender is in the csv referenced by the inputlookup (as it is instantly returning "no results found")

0 Karma
Highlighted

Re: Using a subsearch with inputlookup to filter results returns errors

Motivator

This subsearch works like and AND filter for all values of the field "mail" in the lookupfile.
So in this case it is only the value $MessageSender$, because of your "search mail="$MessageSender$"

index="MessageIndex" AND mail=$MessageSender$

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.