subsearch inserts AND

[mikefoti]

My ultimate goal is to grab the srcIP and time from an event in one index, then search another index for the same srcIP but a time frame +/- 2 minutes. I'm using a subsearch to grab the initial srcip and EVAL to create latest and earliest time values. The subsearch passes the srcip, latest and earliest values just fine but inserts AND between the 3 values. And it seems the outer search does not like, the ANDs.

If I execute this outer search manually it fails with the error "Invalid search: AND AND"

| tstats `summariesonly` count FROM datamodel=Network_Resolution 
WHERE 
DNS.src=10.10.10.122 AND earliest=1559323317 AND latest=1559323517 BY DNS.query_type 

But removing the ANDS works fine

| tstats `summariesonly` count FROM datamodel=Network_Resolution 
WHERE 
DNS.src=10.10.10.122 earliest=1559323317 latest=1559323517 BY DNS.query_type 

So is there away make this subsearch not insert ANDs, or is there a better way to achieve my ultimate goal?

Here's the entire search...

| tstats `summariesonly` count from datamodel=Network_Resolution 
WHERE 
[search
|tstats `summariesonly` 
values(IDS_Attacks.src) AS theSrc 
earliest(_time) AS theTime 
FROM datamodel=Intrusion_Detection 
WHERE IDS_Attacks.signature="Resource Records *"
AND IDS_Attacks.src="10.10.10.122" 
AND _time="1559323417"
| `drop_dm_object_name("Intrusion_Detection")`
| eval earliest=theTime-100, latest=theTime+100
| stats values(theSrc) AS DNS.src 
values(earliest) AS earliest 
values(latest) AS latest
]
BY DNS.query_type

[aromanauskas]

Try:

... | stats min(earliest) AS earliest max(latest) AS latest by theSrc |rename theSrc AS DNS.src | format ] BY DNS.query_type

[mikefoti]

CORRECTION - removing "search" from beginning for subsearch... should say:

| tstats `summariesonly` count from datamodel=Network_Resolution 
 WHERE 
 [
 |tstats `summariesonly`
.
.
.
.