Nested subsearches with lookup

[Janani_Krish]

I have a query structured like below with main search and sub search where the main search includes lookup,

|inputlookup tci|search tag.name="ap" |rename tag.name as tags|dedup indicator|table indicator confidence rating ownerName tags|union[search sourcetype="cisco:*" action=allowed 
|rename src_ip as indicator|dedup indicator|table indicator confidence rating ownerName tags]|stats count values(confidence) as confidence values(rating) as rating values(ownerName) as ownerName values(tags) as tags by indicator|where count>1|table indicator confidence rating ownerName tags

  I wanted the results of this query to be lookup into one more source type and take out raw data. I have tried the below but it doesn't work,

sourcetype="symantec:*"[|inputlookup tci|search tag.name="ap" |rename tag.name as tags|dedup indicator|table indicator confidence rating ownerName tags|union[search sourcetype="cisco:*" action=allowed 
|rename src_ip as indicator|dedup indicator|table indicator confidence rating ownerName tags]|stats count values(confidence) as confidence values(rating) as rating values(ownerName) as ownerName values(tags) as tags by indicator|where count>1|table indicator confidence rating ownerName tags]|table _raw

Please suggest any alternatives to lookout for source type where we have to derive the result from nested sub searches with lookups.

[ITWhisperer]

Have you tried using format?

sourcetype="symantec:*" [|inputlookup tci|search tag.name="ap" |rename tag.name as tags|dedup indicator|table indicator confidence rating ownerName tags|union[search sourcetype="cisco:*" action=allowed 
|rename src_ip as indicator|dedup indicator|table indicator confidence rating ownerName tags]|stats count values(confidence) as confidence values(rating) as rating values(ownerName) as ownerName values(tags) as tags by indicator|where count>1|table indicator confidence rating ownerName tags | format ]|table _raw

[Janani_Krish]

Hi @ITWhisperer 

Tried using format now. But this as well is not returning any results although our inner sub search is returning results.