How to use the results of subsearch?

[smanojkumar]

My requirement is to utilize the results of the sub-search and use it with the results of the main search results, but the sourcetype/source is different for the main search and sub-search, Im not getting the excepted results when using format command or $field_name,

inputlookup host.csv - consists of list of hosts to be monitored

main search 

index=abc source=cpu sourcetype=cpu CPU=all
[| inputlookup host.csv ]
| eval host=mvindex(split(host,"."),0)
| stats avg(pctIdle) AS CPU_Idle by host
| eval CPU_Idle=round(CPU_Idle,0)
| eval warning=15, critical=10
| where CPU_Idle<=warning
| sort CPU_Idle

sub-search
[search index=abc source=top
| dedup USER
| return $USER]

 there is a field host , which is common in both, ,the events from index=abc source=cpu sourcetype=cpu does not contain a USER field, since the USER field is there when source=top, not in source=cpu

[ITWhisperer]

What are you trying to achieve with the events from both searches? In what way are you trying to "utilise" the sub-search? Can you give an example of your expected / desired result?