How can I search events based on another lookup file subsearch using like.

[JMPP]

Hi,

Would you mind to help on this?, I have been working for days to figure out how can I pass a lookup file subsearch as "like" condition in main search, something like:

To examples:
1) 

. . main search| where like(onerowevent, "%".[search [| inputlookup blabla.csv| <whatever_condition_to_make_onecompare_field>|table onecompare }]."%"]])

2)

. . main search| eval  onerowevent=if(like(onerowevent,, "%".[search [| inputlookup blabla.csv| <whatever_condition_to_make_onecompare_field>|table onecompare }]."%"]])),onerowevent,"")

[JMPP]

Hi @richgalloway 

Your sugestion to use return helped me to make the query works. I have made to make some adjustments too :

..main search |where like(onerowevent, [| inputlookup blabla.csv| <whatever_condition_to_make_onecompare_field>| eval onecompare="\"%".onecompare."%\""|return $onecompare]

The only thing is, when I'm using '   |return $onecompare  ', I'm missing one row from the output, even if I test the subsearch separately.

I will figure out what is making ' return ' clause skip the row.

Regards,

[richgalloway]

By default, the return command returns only the first value of the specified fields.  Use return n to return n number of values.

[richgalloway · Accepted solution]

By default, a subsearch returns its results as a formatted string.  Run the subsearch by itself with | format appended to see what it looks like.

A workaround may be to use the return command instead of table.

 main search| eval  onerowevent=if(like(onerowevent,, "%".[search [| inputlookup blabla.csv| <whatever_condition_to_make_onecompare_field>|return $onecompare }]."%"]])),onerowevent,"")