spl query output mismatch

[vinitpathri]

index=_internal host=abc123 source="metrics.log" group=tcpin_connections fwdType=uf
|dedup hostname
|table hostname

i am putting hostname= xyz578(output of above query) in the below query

index=* host=abc123 "xyz578"
but not getting any output

please help me with this missing part.

[richgalloway]

index=* does not match index=_internal. You need index=_* to do that. Yeah, I know, not logical.

[vinitpathri]

sorry but i didnt get it 😄

[richgalloway]

What did you not get?

[vinitpathri]

index=_* should be a subset of index=*

[vinitpathri]

asterik is not visible in the comment :-?

index=_(asterik)should be a subset of index=(asterik)

[richgalloway]

Agreed, but that's not how it works with indexes and Splunk. That's what I meant by "not logical".