Using a subsearch with inputlookup to filter results returns errors

[pacrip]

Hi guys,

Im trying to filter a list of messages coming from my index by checking the sender for membership in a group. I have defined the group in a csv file that contains the emails of each user which i can successfully query using inputlookup, the issue arrives when i wrap that search up as a subsearch and use it as a check in my where command:

index="MessageIndex"
    | where isnotnull([
    | inputlookup ListOfEmails.csv 
    | search mail=$MessageSender$ 
    | rename mail as query 
    | fields query
    | head 1])
| table *

This returns the error:

Error in 'where' command: The expression is malformed. An unexpected character is reached at ') ) '.

I have tried passing the subsearch to an Eval command but i get the same error minus one ')' even though there isn't a ')' in sight. Any ideas?

[HeinzWaescher]

Try this:

index="MessageIndex"
[| inputlookup ListOfEmails.csv
| search mail=$MessageSender$
| rename mail as query
| fields query
| head 1]

[pacrip]

Thanks, that gets rid of the error!

The only issue now is that i'm not sure it is only allowing events where the messagesender is in the csv referenced by the inputlookup (as it is instantly returning "no results found")

[HeinzWaescher]

This subsearch works like and AND filter for all values of the field "mail" in the lookupfile.
So in this case it is only the value $MessageSender$, because of your "search mail="$MessageSender$"

index="MessageIndex" AND mail=$MessageSender$