I have some trouble with search from csv list. If in column is two words divided with space, searching done separately for both Example: sourcetype="WinEventLog:Security" ("Domain Admins") - gives correct result litsearch (index=* sourcetype="WinEventLog:Security" "Domain Admins") | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server" if i try to do like this with list sourcetype="WinEventLog:Security" [| inputlookup group_list.csv | return 10 $group_name] normalizedSearch litsearch (index=* sourcetype="WinEventLog:Security" ((Domain Admins) OR (Domain Users))) | fields keepcolorder=t "*" "_bkt" "_cd" "_si" "host" "index" "linecount" "source" "sourcetype" "splunk_server" group_list.csv group_name Domain Admins Domain Users this search return result where is domain , users, admin found, but not "Domain Admins". Tried adding quotes and delimiters, but this do not help nr,group_name,desc 1,"Domain Admins",super 2,Domain Users,standard ... View more