Actually, I've figured it out. I needed to use the fields operator to specifically select only the field that I want to use to search ( search_id in my case). I also misunderstood the way that subsearches work -- it is important to know that the subsearch is evaluated first, and the result used to augment the outer search. This search term ended up doing what I wanted: sourcetype=catalina* [ search sourcetype=catalina* eventtype=search_fail | fields + search_id ] It was useful to know that the sub-search operation implicitly appends a | format operator on to the end. Combined with the fields + search_id operation, the sub-search term is effectively expanded to something like this: sourcetype=catalina* ( ( search_id="530959" ) OR ( search_id="529947" ) OR ( search_id="529938" ) OR ( search_id="529919" ) OR ( search_id="529793" ) OR ( search_id="529792" ) OR ( search_id="529568" ) OR ( search_id="529559" ) ) which of course produces the output that I was after. ... View more