How to use the results of subsearch?

[smanojkumar]

My requirement is to utilize the results of the sub-search and use it with the results of the main search results, but the sourcetype/source is different for the main search and sub-search, Im not getting the excepted results when using format command or $field_name,

inputlookup host.csv - consists of list of hosts to be monitored

main search 

index=abc source=cpu sourcetype=cpu CPU=all
[| inputlookup host.csv ]
| eval host=mvindex(split(host,"."),0)
| stats avg(pctIdle) AS CPU_Idle by host
| eval CPU_Idle=round(CPU_Idle,0)
| eval warning=15, critical=10
| where CPU_Idle<=warning
| sort CPU_Idle

sub-search
[search index=abc source=top
| dedup USER
| return $USER]

[smanojkumar]

Thanks!, there is a field host , which is common in both

[ITWhisperer]

It is not clear how you want to use the users returned by the sub-search.

Do the events from index=abc source=cpu sourcetype=cpu contain a USER field?

[smanojkumar]

No ,the events from index=abc source=cpu sourcetype=cpu does not contain a USER field, since the USER field is there when source=top, not in source=cpu

[ITWhisperer]

So, how are you going to correlate events from the first search with events from the subsearch?

[smanojkumar]

Thanks!, there is a field host , which is common in both