Try putting the values in double quotes? Also, try to rename the token to some general name and pass to subsearch (sometime that fixes the issue)
<base search> | eval Timestamp=_time| map "search index=a | eval Oldtime=\"$Timestamp$\""
the following worked for me:
| stats count | map search="search index=_internal | head 10 | eval x=$count$" | table x
You should see that you'll end up with 10 events all with x=0.
For some reason it was not working for me until I used x=\"$count$\"
oh, you need to quote it for eval if it's supposed to be a string literal. Or else it will treat it as a field name or a number, which is why $count$ without the quote works if the count is just a number.
Try putting the values in double quotes? Also, try to rename the token to some general name and pass to subsearch (sometime that fixes the issue)
<base search> | eval Timestamp=_time| map "search index=a | eval Oldtime=\"$Timestamp$\""
Wow! the quotes worked! Can you tell me why they're necessary?
I restructured the search backwards. I now have the search that generates the most information as the map search. That way I'm minimizing the amount of fields I need to pass along to the map search