How to append XML from subsearch

[helius]

I'm trying to append xmlkv results to my original search string. Here is what I've tried, and what is not working.

index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval JobID=id | eval XML_SRC=("/opt/elemental_se/web/log/*/job_"+JobID+"/*_emecmd.xml") | convert timeformat="%H%M%S" mktime(completed_at) mktime(started_at) | fieldformat completed_at=strftime(completed_at,"%H:%M:%S") | fieldformat started_at=strftime(started_at,"%H:%M:%S") | eval TimeDiff=completed_at-started_at | eval JobLength=strftime(TimeDiff, "%M:%S") | append [ search source=XML_SRC  "<command value='job'>" | xmlkv ]

Is the XML_SRC going to work in a subsearch like that? Any suggestions on how to achieve this? If anything, I'd like to obtain just one result of the xmlkv in the subsearch. It's named file_size. But there is a bunch more I'd like to eventually include, so I figured just bringing it all in as extra fields would be best.

[helius · Accepted solution]

I was able to figure this out. Here is the final result:

[ search index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval source=("/opt/elemental_se/web/log/*/job_"+id+"/*_emecmd.xml") | table source ] | rex field=source "job_(?<JobID>\d+)" | search "<command value='job'>" | xmlkv | stats count by JobID, file_size | appendcols [ search index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | convert timeformat="%H%M%S" mktime(completed_at) mktime(started_at)  | fieldformat completed_at=strftime(completed_at,"%H:%M:%S")  | fieldformat started_at=strftime(started_at,"%H:%M:%S") | eval TimeDiff=completed_at-started_at  | eval JobLength=strftime(TimeDiff, "%M:%S") ] | table id started_at completed_at JobLength file_size