Search in square brackets

[vanheer]

I don't understand how this works, what should replace the square brackets in this situation or what does the search works here?

index=123 sourcetype=grades [|search index=123 sourcetype=grades line=6 AND class=4|return Name]

Can anyone explain this please?

I've tried to make it more simple with one search and get rid of the square brackets, but I always get different results.

[isoutamo]

Hi

You could evaluate this by running this 

index=123 sourcetype=grades line=6 AND class=4 
| return Name

If you have events which those values it returns

Name="<value of field Name>"

 Then it use that with your outer search 

r. Ismo

[ITWhisperer]

The search in the square brackets (the subsearch) is executed first. The results are then used to filter the main search. For example, if the subsearch returns 3 rows, these will be separate by ORs and the fields returned in each row will be separated by ANDs.

index=123 sourcetype=grades ((line=6 AND class=4 AND index=123 AND _time=<whatever the time of the event is> AND <whatever other fields are in the event>) OR (line=6 AND class=4 AND index=123 AND _time=<whatever the time of the next event is> AND so on))