In a timerange (lets say 4 hours) I am trying to find password resets and after that, for the same user, all the logins.
Is it possible to this in a search? I was looking at append but I don't see how I can use the field user and _time from first search (finding the password resets) to filter the second search (finding the logins)
When you have really tried to understand those two things, try your search/subsearch again and see where that gets you.
Then maybe this helps - the subsearch RUNS FIRST. Right? It runs, and its results get shoved into the main search as search criteria.
mybasesearch [some search that returns a name of either "Billy" or "Sally"]
Ends up being mybasesearch (name=Billy OR name=Sally)
E.g the subsearch JUST returns its results as search items.
(More or less. Unless you change the formatting. Etc... But I mean by default).
if you've tried both things mentioned in the help, an yet still have problems, post your SPL and both the results you get, but also the results you'd expect to have. And a few events from the results of the search (without subsearch) and the subsearch (run independently from the search).