If I understand this correctly, this should work:
index=main auditSource=for-frontend auditType=FormSaved auditType!=FormSubmission
| eval generatedAt=strptime(generatedAt, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y %H:%M" ctime(generatedAt)
| rename generatedAt As "submissiondate"
| rename detail.name As "fullname"
| rename detail.referenceNumber As "refno"
| head 1
| eval Full_Details= "Ref No: ".refno.", Fullname: ".fullname.", Date and Time of submission: ".submissiondate
| makemv delim=", " Full_Details
| table Full_Details
Or if you need the 'auditType=FormSubmission' then:
index=main auditSource=for-frontend (auditType=FormSaved OR auditType=FormSubmission)
.....
And use eval(if(auditType="FormSaved", 'iftrue', 'iffalse'))
Subsearches are a pain, and introduce extra load on your searchhead. Avoid using subsearches if possible.
... View more