Subsearch leading to

[samtheman]

I notice that the below query results in 0 events, whereas the baseSearch alone results in 11 events and the sub-search alone (outside of brackets) results in 5 events.

"baseSearch" |
      [search "baseSearch"
       | rex field=_raw "aRegex(?<status>.*)"
       |rex field=_raw " aRegex(?<requestID>.*)"
       |transaction startswith=eval(status="Started") endswith=eval(status="Completed")
       |eval startTranTime=_time
       |eval endTranTime=_time+duration
       | table startTranTime endTranTime]

Further, when I pipe this subsearch to a where clause comparing this endTranTime to an existing field: where endTranTime > date_time, I get an error: Error in 'SearchParser': Subsearches are only valid as arguments to commands

Also, would I need to have the rex fields outside of the subsearch in order to use them later in the query?

Any suggestions would be really appreciated. Thanks.

[skoelpin]

You should avoid the subsearch and just lump both searches into a single search like this

(index=.... sourcetype=...) OR (index=xxx sourcetype=xxx) 

[samtheman]

The reason for the sub-search is to use the calculated startTranTime and endTranTime fields to do further processing on all of the events from "base search". Specifically I want to use those two times as bounds on a time field that each event has, to further filter them down.

[skoelpin]

So does both base searches have different time parameters? Could you specify the StartTranTime and EndTranTime to represent both searches? Does your first search already have these fields present with different times?