Pass one field from multiple fields returned by subsearch

[Murali2888]

Hi All,

I have a search query like below.

[search A | fields B,C] | search (D OR E) | fields F | table, B,C,F.

Search A returns two fields.
I need to pass the field C to the master search but still want to retain the field B for the final results.
The above query passes both fields B & C to the master search and hence the master search is not return any results.

Is there possible solution for this?

Thanks
Murali

[pacrip]

Hi Murali

I had alot of issues with my subsearches but i found the best way to get back multiple fields from from a subsearch was using Eval (making sure the results are returned using a field called 'query' (dont ask me why)) and then rexing out your fields from the result. Its not very elegant but it gives you visibility and control over the data you are returning.

Im not very good at written explanations so maybe a code example would help:

eval f=[search A | fields B,C | eval query=B+";"+C | table query ] | rex (insert splitting regex here) | search (D OR E) | fields F | table, B,C,F

[Ayn]

No. The subsearch emits a filter string containing all values for B and C. There's no separate "channel" where field values can be returned from a subsearch without having them emitted as a filter string. Depending on your exact scenario, you might want to look into using join, or if you have fairly static data, consider putting your B values in a lookup.

[Murali2888]

thanks @Ayn. I have been using join till now for this query but that has performance impact, so I am exploring other options.