Using the map command to run searches from a lookup.

[paras]

I have this lookup that has a list of searches I want to run.

Screen Shot 2022-06-02 at 8.52.39 AM.png

I want to run a search that can run output the "magic" values search results. The expected search.

This is the search I am using, " | inputlookup test.csv  | map search=$magic$ "

When I run this this is the error I am getting:

" 

Unable to run query '"search index::client* sourcetype::ActiveDirectory | fields admonEventType memberOf sAMAccountName sAMAccountType | head 100 | fieldsummary maxvals=2 | where count > 0 | table field values"'.

"

[ITWhisperer]

Try using a double map

| inputlookup test.csv
| map search="| makeresults | map search="$$magic$$

[chrisyounger]

For anyone else like me in the future trying to get this to work, the solution from @ITWhisperer is for use in a dashboard. You should be able to get this to work outside a dashboard like so: 

| inputlookup test.csv
| map search="| makeresults | map search=\"$magic$\""