I ran into this exact issue today. I was looking to pass starttimeu and endtimeu values from a subsearch to the parent. The values were based on the results of the subsearch so there was no way to add them to the parent at the start. The solution was the format command and removing AND from the colseperator. To correct the original search add | format mvsep="mvseparator" "(" "(" " " ")" "OR" ")" before the end of the subsearch. This works since splunk implies AND to all search values. ... View more