Subsearch only returns 1 value

[Thuan]

The search below produces multiple values for c_ip

index=proxy*
| fields c_ip s_op d_ip r_host d_port cs_bytes cs_uri referer c_agent
| lookup RedSkyIOCip-Proxy Indicator AS d_ip OUTPUT Source ReferenceAttribution
| search Source=RedSkyIOC
| table _time c_ip d_ip Source ReferenceAttribution cs_uri referer c_agent

When it is modified to become a subsearch as below, the subsearch only returns 1 value for c_ip. What is not working?

index=in_index
[ search index=proxy
| fields c_ip s_op d_ip r_host d_port cs_bytes cs_uri referer c_agent
| lookup RedSkyIOCip-Proxy Indicator AS d_ip OUTPUT Source ReferenceAttribution
| search Source=RedSkyIOC
| dedup c_ip
| rename c_ip AS s_ip
| return s_ip ]
| table _time s_ip d_ip d_port action | sort s_ip

[richgalloway]

The return command defaults to returning a single value. Try replacing it with a field command.