https://community.splunk.com/t5/Splunk-Search/Mechanism-to-return-fields-not-part-of-a-query-from-subsearch/m-p/48850#M11689 <P>I'm not sure I understand your aim, but could you use <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append">append</A>, <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendcols">appendcols</A>, or <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join">join</A> to get what you need instead of having a subsearch in your primary search?</P> Wed, 28 Aug 2013 01:25:08 GMT wpreston 2013-08-28T01:25:08Z https://community.splunk.com/t5/Splunk-Search/Mechanism-to-return-fields-not-part-of-a-query-from-subsearch/m-p/48849#M11688 <P>index=abc [index=def a=b | fields c,d,e | format] </P><P><BR /> will create something like </P><P><BR /> index=abc (c=blah) AND (d=foo) AND (e=bar)</P><P><BR /> Instead of e being part of the search, I just want the value of e to be used later in the primary search possibly in a table? I lose the values of the fields in the subsearch. I tried outputing them to an outputlookup in the subsearch and then doing a lookup to pull them back but it appears the outputlookup doesn't flush them out to the file quick enough. If I re-run the search, I will get those results but that is a hack. Any ideas here? </P><P><BR /> Thanks,</P><P><BR /> -Bob</P> Wed, 28 Aug 2013 00:56:13 GMT https://community.splunk.com/t5/Splunk-Search/Mechanism-to-return-fields-not-part-of-a-query-from-subsearch/m-p/48849#M11688 rdownie 2013-08-28T00:56:13Z https://community.splunk.com/t5/Splunk-Search/Mechanism-to-return-fields-not-part-of-a-query-from-subsearch/m-p/48850#M11689 <P>I'm not sure I understand your aim, but could you use <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append">append</A>, <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendcols">appendcols</A>, or <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join">join</A> to get what you need instead of having a subsearch in your primary search?</P> Wed, 28 Aug 2013 01:25:08 GMT https://community.splunk.com/t5/Splunk-Search/Mechanism-to-return-fields-not-part-of-a-query-from-subsearch/m-p/48850#M11689 wpreston 2013-08-28T01:25:08Z https://community.splunk.com/t5/Splunk-Search/Mechanism-to-return-fields-not-part-of-a-query-from-subsearch/m-p/48851#M11690 <P>You made fields part of the result, so it ends up in the result. It does not appear to be part of the search, but if the event contains e and you make e part of your result, then you will end up with e. That's just the way it is.</P> Wed, 28 Aug 2013 01:27:26 GMT https://community.splunk.com/t5/Splunk-Search/Mechanism-to-return-fields-not-part-of-a-query-from-subsearch/m-p/48851#M11690 lukejadamec 2013-08-28T01:27:26Z