Using the map command to run searches from a lookup.

[paras]

I have this lookup that has a list of searches I want to run.

I want to run a search that can run output the "magic" values search results. The expected search.

This is the search I am using, " | inputlookup test.csv  | map search=$magic$ "

When I run this this is the error I am getting:

" 

Unable to run query '"search index::client* sourcetype::ActiveDirectory | fields admonEventType memberOf sAMAccountName sAMAccountType | head 100 | fieldsummary maxvals=2 | where count > 0 | table field values"'.

"

[ITWhisperer]

Try using a double map

| inputlookup test.csv
| map search="| makeresults | map search="$$magic$$