Splunk Search

Using a subsearch with inputlookup to filter results returns errors

pacrip
Path Finder

Hi guys,

Im trying to filter a list of messages coming from my index by checking the sender for membership in a group. I have defined the group in a csv file that contains the emails of each user which i can successfully query using inputlookup, the issue arrives when i wrap that search up as a subsearch and use it as a check in my where command:

index="MessageIndex"
    | where isnotnull([
    | inputlookup ListOfEmails.csv 
    | search mail=$MessageSender$ 
    | rename mail as query 
    | fields query
    | head 1])
| table *

This returns the error:

Error in 'where' command: The expression is malformed. An unexpected character is reached at ') ) '.

I have tried passing the subsearch to an Eval command but i get the same error minus one ')' even though there isn't a ')' in sight. Any ideas?

Tags (1)
0 Karma

HeinzWaescher
Motivator

Try this:

index="MessageIndex"
[| inputlookup ListOfEmails.csv
| search mail=$MessageSender$
| rename mail as query
| fields query
| head 1]

0 Karma

pacrip
Path Finder

Thanks, that gets rid of the error!

The only issue now is that i'm not sure it is only allowing events where the messagesender is in the csv referenced by the inputlookup (as it is instantly returning "no results found")

0 Karma

HeinzWaescher
Motivator

This subsearch works like and AND filter for all values of the field "mail" in the lookupfile.
So in this case it is only the value $MessageSender$, because of your "search mail="$MessageSender$"

index="MessageIndex" AND mail=$MessageSender$

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...