How to edit my search get the subsearch to pass multiple values to the main search?

[rafiqul]

Subsearch returning large number of MAC Address and pass each of them to the main (outer) search to evaluate if they are present.

I have the following example subsearch which yields 100s of DEVICE_MAC_ADDRESS (under conditions in the preceding search), and I need to pass each one of the MAC to the outer search so the result gets me a status of MAC Address if they are present.

sourcetype="aaa-AuthAttempts"  APMacAuth [search sourcetype="aaa-AuthAttempts" | rex "(?<AP_MAC_ADDRESS>[a-fA-F0-9\-]{12,17}\:)" | search NOT AP_MAC_ADDRESS="*" | rex "(?<DEVICE_MAC_ADDRESS>[a-fA-F0-9\-]{12,17})" | rex "QueryCoA\,(?<Dallas_ISG>[^\,]+)"  | table DEVICE_MAC_ADDRESS]

It doesn't seem to be working. Anyone can help me please? Thanks

[somesoni2]

If you want to pass a named field value from the subsearch to main search, the field with same name should be available in main search (which is not here as you're extracting that field using rex). So you've two options,

1) Extract the field in main search and then apply filters using subsearch

sourcetype="aaa-AuthAttempts"  APMacAuth |  rex "(?<DEVICE_MAC_ADDRESS>[a-fA-F0-9\-]{12,17})" | search  [search sourcetype="aaa-AuthAttempts" | rex "(?<AP_MAC_ADDRESS>[a-fA-F0-9\-]{12,17}\:)" | search NOT AP_MAC_ADDRESS="*" | rex "(?<DEVICE_MAC_ADDRESS>[a-fA-F0-9\-]{12,17})"  | stats count by DEVICE_MAC_ADDRESS| table DEVICE_MAC_ADDRESS]

2) Use the text filter instead of named field filter

  sourcetype="aaa-AuthAttempts"  APMacAuth [search sourcetype="aaa-AuthAttempts" | rex "(?<AP_MAC_ADDRESS>[a-fA-F0-9\-]{12,17}\:)" | search NOT AP_MAC_ADDRESS="*" | rex "(?<DEVICE_MAC_ADDRESS>[a-fA-F0-9\-]{12,17})"  | stats count by DEVICE_MAC_ADDRESS| table DEVICE_MAC_ADDRESS | rename DEVICE_MAC_ADDRESS as search ]

[rafiqul]

Thanks ! That helps passing the DEVICE_MAC_ADDRESS to the parent search. The MAC address I am passing includes duplicates. How can I pass distinct MACs from sub search to the parent search ?