The output of the subsearch is actually count=17 , not just the 17 . This is because subsearches are made primarily to output searchterms into other searches. You're not out of luck though, and you dont even have to break out the format command. Subsearches have special behavior where a) if there's only a single field and b) it's called query or search , then it will output only the value. so tack on an | rename count as search ... View more