Noob here. Can anyone tell me why the following search:
search sourcetype=srt | table serialNumber
will give me a one-column table of serial numbers as expected, while the same query in subsearch brackets
[search sourcetype=srt | table serialNumber]
does not return the same table that I expect, but rather returns the full record?
Subsearch outputs are formatted as search string. In your case the result is
serialNumber=serialNumber1 OR serialNumber=serialNumber2 OR ...
You can test the subsearch output by adding format command end of the normal search
search sourcetype=srt | table serialNumber | format
View solution in original post