Show only fields values found in subsearch

[niuk]

I have search like below to show me 'src_ip' and 'count' every last 10 min

index="pan" sourcetype="pan:threat" earliest=-10m action=allowed NOT [| inputlookup Exclusions | fields src_ip] | stats count by src_ip| where count > 10 | sort - count

1.1.1.1 10

2.2.2.2 12

and second search to show only src_ip in last 24h (to eliminate src_ip repeated in any of 10 min periods for last 24h)

index="pan" sourcetype="pan:threat" earliest =-24h action=allowed NOT [| inputlookup Exclusions ] | bin _time span=10m | stats count by _time src_ip | where count > 10 | stats count by src_ip | where count = 1 | fields - count

but combined search to show my only src_ip with count where src_ip is present in subsearch is not working correctly .. because src_ip values are not unique in subsequent 10 min interval

index="pan" sourcetype="pan:threat" earliest=-10m action=allowed NOT [| inputlookup Exclusions | fields src_ip] | stats count by src_ip| where count > 10 | sort - count IN [index="pan" sourcetype="pan:threat" earliest =-24h action=allowed NOT [| inputlookup Exclusions ] | bin _time span=10m | stats count by _time src_ip | where count > 10 | stats count by src_ip | where count = 1 | fields - count]

[richgalloway]

I suspect one reason the combined query is not working correctly is the questionable syntax.  Specifically, the sort - count IN [<subsearch].  Splunk will attempt to sort the results by the count and IN fields as well as the text returned by the subsearch (interpreted as column names).  It may sort results, but they won't be the expected results.

When working with subsearches, always run the subsearch by itself with | format appended to it.  The resulting string is what will be added to the main search and executed.  Make sure the result make sense as part of the main search.

[niuk]

Appreciate looking at it , I run subsearch with '| format' and got below (...cut output)

( ( src_ip="10.1.136.6" ) OR ( src_ip="10.1.2.4" ) OR .....cut output )

Does the format of subsearch looks good ? Dont know how to pipe that subsearch other than inserting IN after main search...