Sub search not returning string

[joeybroesky]

Why does a sub search return a boolean value? I am expecting to see the department value.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return department])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

Search shown below:

[joeybroesky]

Added format to the end of the sub search resolved the issue.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

[manjunathmeti]

That's great! I updated my answer so that it can help others looking for similar problem.

[manjunathmeti · Accepted solution]

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

[joeybroesky]

This returns "Null" for From_Sub_Search instead of "True".

See accident answer below.

[manjunathmeti]

what is the output of index="activedirectory" (userPrincipalName="@emailaddress.ca") | fields department ?

[joeybroesky]

It return the raw event data. If I table "department" it is correct.