https://community.splunk.com/t5/Splunk-Search/Nested-subsearches-with-lookup/m-p/573268#M199790 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR /><BR />Tried using format now. But this as well is not returning any results although our inner sub search is returning results.</P> Tue, 02 Nov 2021 06:38:13 GMT Janani_Krish 2021-11-02T06:38:13Z https://community.splunk.com/t5/Splunk-Search/Nested-subsearches-with-lookup/m-p/573133#M199767 <P>I have a query structured like below with main search and sub search where the main search includes lookup,</P><LI-CODE lang="markup">|inputlookup tci|search tag.name="ap" |rename tag.name as tags|dedup indicator|table indicator confidence rating ownerName tags|union[search sourcetype="cisco:*" action=allowed |rename src_ip as indicator|dedup indicator|table indicator confidence rating ownerName tags]|stats count values(confidence) as confidence values(rating) as rating values(ownerName) as ownerName values(tags) as tags by indicator|where count&gt;1|table indicator confidence rating ownerName tags</LI-CODE><P>&nbsp; I wanted the results of this query to be lookup into one more source type and take out raw data. I have tried the below but it doesn't work,</P><LI-CODE lang="markup">sourcetype="symantec:*"[|inputlookup tci|search tag.name="ap" |rename tag.name as tags|dedup indicator|table indicator confidence rating ownerName tags|union[search sourcetype="cisco:*" action=allowed |rename src_ip as indicator|dedup indicator|table indicator confidence rating ownerName tags]|stats count values(confidence) as confidence values(rating) as rating values(ownerName) as ownerName values(tags) as tags by indicator|where count&gt;1|table indicator confidence rating ownerName tags]|table _raw</LI-CODE><P><BR />Please suggest any alternatives to lookout for source type where we have to derive the result from nested sub searches with lookups.</P> Mon, 01 Nov 2021 09:07:07 GMT https://community.splunk.com/t5/Splunk-Search/Nested-subsearches-with-lookup/m-p/573133#M199767 Janani_Krish 2021-11-01T09:07:07Z https://community.splunk.com/t5/Splunk-Search/Nested-subsearches-with-lookup/m-p/573140#M199769 <P>Have you tried using format?</P><LI-CODE lang="markup">sourcetype="symantec:*" [|inputlookup tci|search tag.name="ap" |rename tag.name as tags|dedup indicator|table indicator confidence rating ownerName tags|union[search sourcetype="cisco:*" action=allowed |rename src_ip as indicator|dedup indicator|table indicator confidence rating ownerName tags]|stats count values(confidence) as confidence values(rating) as rating values(ownerName) as ownerName values(tags) as tags by indicator|where count&gt;1|table indicator confidence rating ownerName tags | format ]|table _raw</LI-CODE> Mon, 01 Nov 2021 10:45:56 GMT https://community.splunk.com/t5/Splunk-Search/Nested-subsearches-with-lookup/m-p/573140#M199769 ITWhisperer 2021-11-01T10:45:56Z https://community.splunk.com/t5/Splunk-Search/Nested-subsearches-with-lookup/m-p/573268#M199790 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;<BR /><BR />Tried using format now. But this as well is not returning any results although our inner sub search is returning results.</P> Tue, 02 Nov 2021 06:38:13 GMT https://community.splunk.com/t5/Splunk-Search/Nested-subsearches-with-lookup/m-p/573268#M199790 Janani_Krish 2021-11-02T06:38:13Z