topic Difference between outputs of same query as search and subsearch in Splunk Search https://community.splunk.com/t5/Splunk-Search/Difference-between-outputs-of-same-query-as-search-and-subsearch/m-p/545004#M154333 <P>Noob here. Can anyone tell me why the following search:</P><P>search sourcetype=srt&nbsp; | table serialNumber</P><P>will give me a one-column table of serial numbers as expected, while the same query in subsearch brackets</P><P>[search sourcetype=srt&nbsp; | table serialNumber]</P><P>does not return the same table that I expect, but rather returns the full record?</P> Tue, 23 Mar 2021 20:42:59 GMT ebarnhill 2021-03-23T20:42:59Z Difference between outputs of same query as search and subsearch https://community.splunk.com/t5/Splunk-Search/Difference-between-outputs-of-same-query-as-search-and-subsearch/m-p/545004#M154333 <P>Noob here. Can anyone tell me why the following search:</P><P>search sourcetype=srt&nbsp; | table serialNumber</P><P>will give me a one-column table of serial numbers as expected, while the same query in subsearch brackets</P><P>[search sourcetype=srt&nbsp; | table serialNumber]</P><P>does not return the same table that I expect, but rather returns the full record?</P> Tue, 23 Mar 2021 20:42:59 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-outputs-of-same-query-as-search-and-subsearch/m-p/545004#M154333 ebarnhill 2021-03-23T20:42:59Z Re: Difference between outputs of same query as search and subsearch https://community.splunk.com/t5/Splunk-Search/Difference-between-outputs-of-same-query-as-search-and-subsearch/m-p/545028#M154340 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232822">@ebarnhill</a>,</P><P>Subsearch outputs are formatted as search string. In your case the result is&nbsp;</P><LI-CODE lang="markup">serialNumber=serialNumber1 OR serialNumber=serialNumber2 OR ...</LI-CODE><P>You can test the subsearch output by adding format command end of the normal search</P><LI-CODE lang="markup">search sourcetype=srt | table serialNumber | format</LI-CODE> Wed, 24 Mar 2021 03:48:52 GMT https://community.splunk.com/t5/Splunk-Search/Difference-between-outputs-of-same-query-as-search-and-subsearch/m-p/545028#M154340 scelikok 2021-03-24T03:48:52Z