My rules is to check for hits from the list, which the list might contains quite a huge data.
For example the rule is: ip.dst = $[list]
List: 184.108.40.206, 220.127.116.11,......, etc.
When I drill in to particular hits, the query should be: (ip.dst = 18.104.22.168, 22.214.171.124, ....... +2000 character).
But it end up to be: (ip.dst = 126.96.36.199, 188.8.131.52, ......., 184.108.40.206
It stops half way. And having issues of syntax error, which in this case is due to the "(".