How do I assign an extracted field from a subsearch to be the source in an outer search?

[pmaitra]

I have a search from which I extracted field A. In the second search, how do I assign A to be the source of the second search?

For example :
I am using the below query:

index=something  host=somevalue source=something/something/something/something/A    B  [search eventtype=somevalue | table A | dedup A | fields + A] | table B

From the above query what I am expecting is :

My subsearch will return field A.
My outer search will use field A as a source in which I will get result B .

Please help me out with this.

Thanks in advance.

[niketn]

Do you expect single value for field A or multiple?

[gokadroid]

If you want to search the values stored in field A from internal search as strings in your outer search and then tabulate the field B in outer search then give this a try please (Notice I have removed plain B from this search in outer search:

index=something host=something source=x/x/x/A  
[search index=something host=something source=y/y/y/y | table A | dedup A | return 10000 $A ] 
| table B

Here both A and B are field names. In your comment's example, searching for a field B just by placing the field name B in outer search won't help which I quote below:

index=something host=something source = x/x/x/A B [search index=something host=something source=y/y/y/y | table A | dedup A | fields + A ] | table B

It should be B=something in the outer search of your comment.

[sundareshr · Accepted solution]

Try this

*UPDATED*

index=something  host=somevalue  [search eventtype=somevalue | table A | dedup A | eval A="x/x/x/x/".A | rename A as source ] | table B

[pmaitra]

Hey Sundareshr thanks!

I used your updated query and got exactly what I want the source to be in my outer query. But unfortunately it is still resulting in 0 events. Please help if you have any other way out!

[pmaitra]

Thank you very much for showing me the correct path. The only change I did is I added fields + A and then renamed A as source as suggested by you and it worked magically . Thank you very very much.