Creating Field from Inputlookup

[TooManyQuestion]

Hello.
I'm trying to create a field for all events in a search. The field is a value from a inpulookup. There is no shared fields between the lookup and the search in the conventional sense. The organization of my lookup is as follows

ID     email1                            email2                           email3

1      [email protected]        [email protected]       [email protected]

2     [email protected]        [email protected]        [email protected]

3     [email protected]        [email protected]         [email protected]

4     [email protected]      [email protected]      [email protected]

|inputlookup email.csv
            | search ID = "1"
            | strcat email1", " email2", " email3 emails
            | table emails

The above searches gives me my desired output of
emails=[email protected], [email protected], [email protected]

But when I pop in into an eval statement to give each event that field/value I get an error about a malformed eval.

Below is the eval I am trying to do.

index=main (insert search here)
|eval test =[|inputlookup email.csv
            | search ID = "1"
            | strcat email1", " email2", " email3 emails
            | return $emails
            ]

Any help would be greatly appreciated. Thanks!

[renjith_nair · Accepted solution]

Try

index=main (insert search here)
|eval [|inputlookup email.csv
            | search ID = "1"
            | strcat email1 ", " email2 ", " email3 emails
            | return emails
            ]

[inventsekar]

Hi @renjith_nair / all, 

index=main | eval [|inputlookup ..... |return emails]

for SPL newbies, could someone explain this "eval" part, thanks. 

Best Regards,

Sekar

[TooManyQuestion]

Thanks! That got me there! I knew I was just messing up something small and couldn't work it out.

index=main (insert search here)
|eval [|inputlookup email.csv
            | search ID = "1"
            | strcat email1 ", " email2 ", " email3 emails
            | return emails
            ]

Just had to remove the emails before the subsearch otherwise it gave me "emails emails" as the field name!

[renjith_nair]

Yes, removed extra field. My bad, I forgot that 🙂