Splunk Search

Using a subsearch with inputlookup to filter results returns errors

pacrip
Path Finder

Hi guys,

Im trying to filter a list of messages coming from my index by checking the sender for membership in a group. I have defined the group in a csv file that contains the emails of each user which i can successfully query using inputlookup, the issue arrives when i wrap that search up as a subsearch and use it as a check in my where command:

index="MessageIndex"
    | where isnotnull([
    | inputlookup ListOfEmails.csv 
    | search mail=$MessageSender$ 
    | rename mail as query 
    | fields query
    | head 1])
| table *

This returns the error:

Error in 'where' command: The expression is malformed. An unexpected character is reached at ') ) '.

I have tried passing the subsearch to an Eval command but i get the same error minus one ')' even though there isn't a ')' in sight. Any ideas?

Tags (1)
0 Karma

HeinzWaescher
Motivator

Try this:

index="MessageIndex"
[| inputlookup ListOfEmails.csv
| search mail=$MessageSender$
| rename mail as query
| fields query
| head 1]

0 Karma

pacrip
Path Finder

Thanks, that gets rid of the error!

The only issue now is that i'm not sure it is only allowing events where the messagesender is in the csv referenced by the inputlookup (as it is instantly returning "no results found")

0 Karma

HeinzWaescher
Motivator

This subsearch works like and AND filter for all values of the field "mail" in the lookupfile.
So in this case it is only the value $MessageSender$, because of your "search mail="$MessageSender$"

index="MessageIndex" AND mail=$MessageSender$

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...