Nothing stands out as wrong with that search. I'd suggest reviewing the job inspector, maybe the keywords or remotesearch fields (Job -> Inspect Job, expand search properties) - that should give you an idea if the subsearch is working as you expect. I think a lookup is fine approach. If you have the ability, you could install the Lookup Editor app, which provides an excel-like experience for modifying lookups. Or you could use the outputlookup command overwrite the lookup. Typically that would involve using inputlookup to get the events, using where/append/etc to modify the results, then using outputlookup to write it back.
... View more