Passing fields into multiple searches w/out using Map Cmd

[McThunderStick]

*I would typically use the map command for this, but it's currently broken and support is working to fix it

That being said, I'm trying to take a value from search1, pass it to search2 , grab  a field from that 2nd search, and also pass that to 3rd search. Hopefully one of you lovely people can point me in the right direction.

IE:

index=foo | rex field field1

index=boo field2=$field1$ | table src_ip

index=bar src_ip=$src_ip$ | stats  values(domain) etc etc

Any help on this would be supremely appreciated

[to4kawa]

index=foo OR index=boo OR  index=bar | rex field field2|eventstats dc(index) as flag1 by field2 |  stats  values(domain) etc etc dc(index) as flag values(flag1) as flag1 by src_ip |where flag1=2 AND flag > 1

[richgalloway · Accepted solution]

It looks like subsearches may do the job.

index=bar 
  [ index=boo 
    [index=foo | rex field field1 | rename field1 as field2 | format]
  | return src_ip ]
| stats  values(domain) etc etc