inputlookup like:
user mailbox
smithj john smith
bloggsj joe bloggs
search string:
| inputlookup usermailbox.csv | fields search user mailbox | format "(" "(" "AND" ")" "OR" ")"]
returns
( ( user="smithj" AND mailbox="john smith" ) OR ( user="bloggsj" AND mailbox="joe bloggs") OR...
what i want is to return
( ( user="*smithj*" AND mailbox="*john smith*" ) OR ( user="*bloggsj*" AND mailbox="*joe bloggs*") OR...
Current workaround is to put the wildcards * in the csv values like so but this is a pain
user mailbox
*smithj* *john smith*
*bloggsj* *joe bloggs*
You could use eval to add them in manually at search time;
| eval user="*".user."*"
No, unfortunately that doesn't work.