How to properly evaluate integer list from inputlookup subsearch?

[oneillryan93]

I'm attempting to use a subsearch to extract a number of integers in order to transpose those integers as columns. Here is the code for the subsearch:

|eval thing=[| inputlookup lookup.csv
| stats values(tests) by tests
| sort 15 -tests
| stats values(tests) as str
| return $str]

The search run by itself returns something like "123 124 125 126 127...", so I'm confused why when I run it as a subsearch it returns:

"Error in 'eval' command: The expression is malformed."

I've tried following some similar examples I've seen here, but I can't seem to find anything that works for me.
Thanks.

[somesoni2]

The return command, by default, returns only the single value from first row of specified field (as string). The field 'str' in your subsearch is a multivalued field and thus causes issue in eval. Assuming you want to return list of all 15 'tests' values in a space-delimited string and save it to field 'thing', try something like this

...|eval thing=[| inputlookup lookup.csv | stats values(tests) by tests | sort 15 -tests | stats values(tests) as str | nomv str | eval str="\"".str."\"" | return $str]

The nomv command changes 'str' to a single valued field and next eval will add double qoutes around values as it'll be a space delimited string.