Why is my subsearch not working?

[utk123]

I am trying the below subsearch, but it's not giving any results. "No results found. Try expanding the time range. "

I want to get the IP address from search2, and then use it in search1.

Search1 (outer search): giving results

index=index1 sourcetype=sourcetype1 IP_address

Search2 (inner search): giving results

index=index2 sourcetype=sourcetype2 category=category2 | top limit=1 src| table src

subsearch: not giving results

index=index1 sourcetype=sourcetype1 [search 
index=index2 sourcetype=sourcetype2 category=category2 | top limit=1 src| table src]

Am I missing anything here ?

[niketn · Accepted solution]

@utk123 try the following search. rename src as IP_address is required as index1 has field IP_address:

index=index1 sourcetype=sourcetype1 
    [ search 
        index=index2 sourcetype=sourcetype2 category=category2 
    | top limit=1 src showcount=f showperc=f 
    | rename src as IP_address]

[utk123]

Thanks, that was the trick. I had to use same field name for IP address in both queries.
My final query which is working now:

index=index1 sourcetype=sourcetype1 [search
index=index2 sourcetype=sourcetype2 category=category2 | table src | rename src as IP_address]

[askkawalkar]

@utk123 , To get result of above subsearch, src field result need to be present in Search 1. If this criteria is fulfilled, then query will work. n events will be return by search.

Please refer below queries -
Below query will return the result-

index=_internal group=pipeline
    [search index=_internal component=Metrics | top limit=1 name | table name]

Below Query might not return a result

index=_internal group=executor
    [search index=_internal component=Metrics | top limit=1 name | table name]

PS: Above queries are heavy query.