How to use an evaluated field in search command?

[biju_babu]

Could you please let me know how to use an evaluated field in search command

index=main sourcetype="access_combined"

| eval field1="search-val1|search-val2"

| eval searchval=mvindex(split(field1,"|"),1)

| search "*search-val2*"

I am trying to create a dashboard with one of the search as above. I get the field1 value from dropdown list in dashboard. Something like 

| eval field1 = $searchkey$

The above works with the static value in search command but I am trying to use searchval field in search command like

| search 'searchval'

Can someone help? Thanks for the help.

[yuanliu · Accepted solution]

Is there any reason why "search" is the only choice command?  Why not use where?  For example,

| where match(_raw, searchval)

[biju_babu]

what if i use "where" command to set the source. does it impact the performance?

Example using #2 instead of #1

1. index=main sourcetype="access_combined" source="app1"

2. index=main sourcetype="access_combined" | where match(source,"app1")

[yuanliu]

This will affect performance mainly because the first search in #2 will return more events than that in #1.

As a side, if source is precisely "app1", do not use match().  Just say | where source=="app1".  A callout to a function adds to memory and compute; and match() is a regex function, adds even more compute.

[ITWhisperer]

Try something like this

| search [| makeresults
          | fields - _time
          | eval field1 = $searchval$]

[biju_babu]

sorry - that is not working.

Basically, I need to execute command like this

index=main sourcetype="access_combined" "*search-val2*"

where "search-val2" get evaluate from pipe(|) separated string

[ITWhisperer]

Do the separation in the makeresults subsearch

| search [| makeresults
          | fields - _time
          | eval field1 = $searchval$
          | eval query=mvindex(split(field1,"|"),1)
          | fields query]