| input lookup return ALL rather than specify number

[robf]

I'm trying to add this to my search but the number of lookup users may change!!

(|inputlookup lotsofusers.csv | return 3 $users)

((user1) OR (user2) OR (user3))

Is there a better way to do this? * does not work.

Thanks

[orion44]

It would be nice to know the answer to this question. Why do we have to specify a hardcoded value of records to return when using inputlookup? The logical thing to do is check all records.

[somesoni2]

Give this a try

your base search  [|inputlookup lotsofusers.csv | eval search=users | table search]

[aweitzman]

If you're using it as a subsearch, you can use the fields command to reduce what gets returned without needing return. Try this:

[|inputlookup lotsofusers.csv | fields users]

You should get all of them.

[robf]

thanks but this gives

((user=user1) OR (user=user2) OR (user=user3))

i want to search keywords only

((user1) OR (user2) OR (user3))

with the return command you can use the $ symbol to achieve this

[aweitzman]

How about this:

[|inputlookup lotsofusers.csv | fields users | format | rex field=search mode=sed "s/user=//g"]

[fdi01]

try as:
[|inputlookup lotsofusers.csv | return 3 $users]

[robf]

i dont think you understood the question... i don't want to specify how many users. it could be 3 , 300, 3333...