How to use a sub-search result value as a search query in the main search

[leykmekoo]

Hello, 

I've been attempting to use the results of a sub-search as input for the main search with no luck. I'm getting no results. Based on the query below, I was thinking of getting the field value of Email_Address  from the sub-search and passing the result to the main search (in my mind only the Email_Address value). Finally, thinking the main search now has the resulting values from the sub-search (the Email_Address field), it then runs the main search using the passed value (Email_Address) as a search criteria to find events from another index. Is that the correct way to pass values as a searchable value or am I wrong? If I'm wrong, how can I do this? I thank you all in advance for your assistance! 

index=firstindex Email_Address

[search index=secondindex user="dreamer"

     | fields Email_Address

     | head 1 ]

|table Date field1 field2 Email_Address

[bowesmana]

In your outer search 

index=firstindex Email_Address

remove the word "Email_Address" - I assume you want to look for a field that is called Email_Address in the firstIndex data using the values coming from the subsearch, but with this search you are looking for the WORD Email_Address as well as the value of the Email_Address FIELD  coming from the subsearch.

You can see what a subsearch returns by running it on its own and using the | format specifier, e.g.

index=secondindex user="dreamer"
| fields Email_Address
| head 1 
| format

[gcusello]

Hi @leykmekoo,

are you sure that the field to use as search key is exactly named "Email_Address" in both the searches and that values are compatible?

if you manually extract a value from the subsearch, do you have results using this result in the main search?

Ciao.

Giuseppe