how can i pass the field values from one search to my subsearch or to another search

[Nadhiya123]

index=xx sourcetype=yy |eval ..|table aa
[| search index=xx1 sourcetype=yy1 yy=aa values |table yy zz ff ] in a single search ..

[gcusello]

Hi Nadhiya123,
if you want to use a field of the soubsearch to filter the main search you have to run something like this:

index=xx1 sourcetype=yy1  [ search index=xx sourcetype=yy |eval .. | rename aa AS yy | table yy ]
|table yy zz ff

you have only to put attention that fieldname is the same both in main and sub search (use rename command in subsearch) and remember that subsearch has 50,000 events limit.

If instead you want to use a field to join two searches, you can run something like this:

index=xx sourcetype=yy 
| eval ..
| join aa [| search index=xx1 sourcetype=yy1 ]
| table aa yy zz ff 

Bye.
Giuseppe

[Nadhiya123]

how can I include maxout in my subsearch since its truncating the results

[gcusello]

To modify the 50,000 limit for subsearches results you have to modify limits.conf file, but with attention!
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf?ac=partner_smt
bye.
Giuseppe

[Nadhiya123]

Is there an option to include in the SPL query

[gcusello]

No! only in limits.conf configuration file.
Bye.
Giuseppe