I am aware that an eval in the parent search cannot be used in a subsearch like this -
| eval foo = ..... | eval bar = [search index='event' | eval alice = foo/10]
if subsearch is out of the question, then are joins the only way we can achieve this? Also, is it possible to return a multivalued field(list) in the above query and store it in bar, instead of returning a single number(like count using return $count). If so, how is it done?
Basically if I have an eval in one search and I want to extract a list of data from another search index where that eval needs to be used, how is it achieved?