Can you help me with an issue using macros and inputlookup with a metasearch?

[lakshman239]

I can run |metasearch ((index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2)) and it works — no issues.

I can create a macro, say mysrc with definition (index=IN1 sourcetype=S1) OR (index=IN2 sourcetype=S2) and |metasearch mysrc works.

However, if I change the definition of the macro to pull the above search string via a lookup table |inputlookup mysrc |fields index sourcetype | format, the search "|metadata mysrc doesn't work and throws an error in metalitsearch:

 Invalid metasearch. rawdata is required for this search.

Is this a known issue with the metasearch and lookup? Thx in advance

[skoelpin · Accepted solution]

Well yeah.. You're telling Splunk to start with a lookup table then appending a metasearch onto it. Metasearch is a generating command and must come first. Why start with inputlookup anyways? You can use a simple lookup command after the metasearch command

You're also using metadata and metasearch interchangeably in your question

[lakshman239]

Thx Steve. At the moment, I use lookup after metasearch, but was looking to see if it can leverage the formatted search string parsed via lookup to restrict the scope of metasearch. Looks like it cannot handle lookups that way.

[skoelpin]

You can always format the search string while using the lookup after the metasearch. It seems like your problem is solved, can you accept/upvote the answer to close it out?

[skoelpin]

@lakshman239 did this answer your question? If so, can you accept it?