Why not the simpler with negative index: substr(x,-3) ... View more

Great, now that you established that, you have to make sure your base search returns events with MAC field defined. What I like to do in these type of filtering operations, is to add the qualifier to the base search, so in your case: index="blah" sourcetype="cvr-mesos-stdout" source="*latest*" MAC="*" cvr-livecache-service thumbnail "POST /" [ | inputlookup blahQAMACs.csv ] ... Note that case matters, so if your field is called "mac" or "Mac" the above will return zero events. ... View more

Assuming the column name in your lookup matches field name in your base search you should be able to restrict it simply by: your_base_search | search [ | inputlookup yourlookup.csv ] To test it check what the inner search evaluates to first: | inputlookup yourlookup.csv | format which should evaluate to: ((MAC="blah") OR (MAC="anotherblah") OR ...) If it didn't work properly, you might try: | inputlookup yourlookup.csv | format "(" "(" "" ")" "OR" ")" ... View more

Can you clarify "You can't use it later" comment for outputcsv command? The data is very much accessible through | inputcsv - I use this all the time. ... View more