splunk inputlookup subsearch invalid argumenmt

`aws-inspector-findings` serviceAttributes.assessmentRunArn='*' `aws-inspector-rex-arn` | search (accountId='*') (region='*')| dedup arn| search (severity='*')| spath OUTPUT=agentId assetAttributes.agentId | where isnotnull(agentId)| eval CreatedAt=substr(createdAt, 1, 19) | join type='left' lesPackageArn | rename packageName as 'Rules Package'| eval Links = if(isnotnull(agentId), 'Show in Topology | Show Instance Details', '') | sort -numericSeverity | join agentId type='left' | rename severity as Severity, id as Rule, agentId as 'EC2 Instance ID', tags. Splunk, Splunk>, Turn Data Into Doing, Data-to. Merging result of inputlookup file with subsearch to get required results. | inputlookup SenderRecipDomains.I am sharing the query with you here so kindly advise. I get the error Error in inputlookup command: Invalid argument: NOT. So if 'User Id' found in 1st Query also found in either 2nd Query and 3rd Query then exclude that 'User Id' row from main result 1st Query. Which means that part 1 is now working - many thanks. The above output is excluding the results of 2nd Query and 3rd Query from main search query result (1st Query) based on the field value of 'User Id'. So I am running this to get all the data from my CSV | inputlookup SenderRecipDomains.csv | return 9999 Domain Inputlookup pulls in the contents of an entire file for you. | inputlookup SenderRecipDomains.csv | return 2 Domain The subsearch is run first and is contained in square brackets.

However, it appears that 'return' requires a 'count' which leads to this query and result argument parsing and subsearch evaluation. A subsearch runs its own search and returns the results to the parent command as the argument value. So if I run this query | inputlookup SenderRecipDomains.csv | return Domain The appendcols command cant be used before a transforming command because it must append to an existing set of table-formatted results, such as those generated by a transforming command. As stated before this query | inputlookup SenderRecipDomains.csv The appendcols command must be placed in a search string after a transforming command such as stats, chart, or timechart.

Splunk inputlookup subsearch invalid argumenmt