Pass Value to macro with inputlookup to return value

[tdoSplunk]

Hi,

perhaps it is the wrong approach, but i try to use an inputlookup within a search and pass a value to this subsearch.
It looks like this:

    index=myindex sourcetype=stype source=sourcename
    |eval SourceHost =[|inputlookup transfer_nodes.csv 
                       |search nodeId IN ($last_source_node_id$)
                       |fields name
                       |stats first(name) as SourceHost
                       |eval SourceHost="\"".SourceHost."\""
                       |return $SourceHost
                      ]
|eval DestinationHost =[|inputlookup transfer_nodes.csv 
                       |search nodeId IN ($last_dest_node_id$)
                       |fields name
                       |stats first(name) as DestinationHost
                       |eval DestinationHost="\"".DestinationHost."\""
                       |return $DestinationHost
                      ]
    |table name,SourceHost,DestinationHost

I get the following error: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

The problem is the passing of the value $last_source_node_id$ ($last_dest_node_id$)

I already tried to map the subsearch, then the passing works, but the result is not what i expected.

Finally I would like to use a macro like GetTransferNode($last_nodeId$)

Hope you have an idea how to solve it.

best regards and thank you in advance !

[tdoSplunk]

https://answers.splunk.com/answers/797495/pass-value-to-subsearch-with-inputlookup-1.html

I posted it twice, sorry

[nickhills]

I maybe missing something in the detail or your use case, but is there a reason you cant use a normal lookup rather than inputlookup?

Are you able to provide some sample data?