search on subsearch using data from main search results

[taufiqkpi]

hello Splunkers!
I've got an issue with this query, in "main search" I got data src, can I use "src" to get data on my "second search".
later on, the final result ignored from "main search "
anyone can help me?
thanks,

index=VPN | table src -> main search
    [search index=firewall | table src dest_ip] -> second search
    | table src dest_ip

[scelikok]

So, my search should work for you.

[taufiqkpi]

Sorry this solution not solving my problem

[scelikok]

Hi @taufiqkpi,

I think you want to filter VPN sources from Firewall index, please try below;

search index=firewall NOT 
    [ index=VPN 
    | fields src] 
| table src dest_ip

[taufiqkpi]

Sory sir @scelikok, I mean from main search we get src fields.

index=VPN | table src

after this, fileds src from "main search" as search data to "second search"

[search src="from data main search" index=firewall | table src dest_ip]
    | table src dest_ip