How to pass values to a eval if subsearch?

[pierre_weg]

Hi guys!

I have a sourcetype "A" with some info about infrastructure. Host IP is one of this info.

I have another sourcetype "B" (same index) that have a list of critical IPs.

What I'm trying to do is to use eval and IF to set a field value if the IP from sourcetype "A" are present on sourcetype "B".

Fixing the IP value on the subsearch, the result is correct.

index=lab | eval XPTO=if([ search index=lab sourcetype=B IP="192.168.1.2"],1,0)

but I need to pass the IP dynamically from the main search. Something like... 

index=lab | eval XPTO=if([ search index=lab sourcetype=B IP=$IP$],1,0)

it's a simple question, like an Excel VLOOKUP function.

Did you have a suggestion?

[pierre_weg]

Thanks @PickleRick 
I found a solution that seem to retrieve what I need just doing this

index=lab sourcetype=A
| eval XPTO=if([ search index=lab sourcetype=B | fields IP],"yes","no")

[PickleRick]

In such a limited case it might indeed work. Be wary however that it will most probably produce an overly complicated eval if condition (and - as usual - subsearch is limited by the usual number of returned rows and subsearch duration)

[PickleRick]

1. You don't do it this way. You simply can't. The subsearch is run before your main search and its result is rendered - simplifying a bit - as a string which is pasted into the main search.

2. Even if it worked that way, this kind of search would mean that there would have to be a subsearch spawned for each row of the main search. It would be highly ineffective.

3. You can simulate something similar with the map command, but its use is highly discouraged if you can avoid it.

4. Typically those kinds of searches are done using search or two appended ones with some clever statsing to match data from two datasets.