Using data model inside subsearches

[adrab]

Hello,
I'm working on analysis of data coming from some web scan app.
I have to compare the results from two scan executions. Inspired by this answer I've got this working:

| set diff [search index=webscan sourcetype=webscan message="Done exchange {exchange}" scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T20:59:18| stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url] [search index=webscan sourcetype=webscan message="Done exchange {exchange}" scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T18:57:32 | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url]

The problem appears when I try to use a data model in subsearches - the following does not work (shows "No results found"):

| set diff [| datamodel WebScan Exchanges search | search scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T20:59:18| stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url] [| datamodel WebScan Exchanges search | search scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T18:57:32 | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url]

in spite of the fact that subsearches run separatly works as expected.
What should be changed?

Ultimately, I would like to define a macro exchanges_of(2) like

datamodel WebScan Exchanges search | search scanId=$scanId$, execId=$execId$ | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url

and do this:

| set diff [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1, 2018-05-24T20:59:18)`] [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1,2018-05-24T18:57:32)`]

but this also returns "No results found."

And it would be great if I could do something like

| `exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1, 2018-05-24T20:59:18)` NOT  [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1,2018-05-24T18:57:32)`]

for "one side" diff. Is it possible?

[adrab]

*this answer means https://answers.splunk.com/answers/151315/how-to-find-differences-between-two-searches-with-set-diff...l