My rules is to check for hits from the list, which the list might contains quite a huge data.
For example the rule is: ip.dst = $[list]
List: 22.214.171.124, 126.96.36.199,......, etc.
When I drill in to particular hits, the query should be: (ip.dst = 188.8.131.52, 184.108.40.206, ....... +2000 character).
But it end up to be: (ip.dst = 220.127.116.11, 18.104.22.168, ......., 22.214.171.124
It stops half way. And having issues of syntax error, which in this case is due to the "(".