Hello, Need some help here.  The goal is to pass one IP_Address found in inner search to outer search. IP is correctly extracted, but I'm getting following error from "where" command and clueless at this point.  Here's the error: Error in 'where' command: The operator at '10.132.195.72' is invalid. And here's the search: index=ipam sourcetype=data earliest=-48h latest=now() | where cidrmatch(name, IP_Address) [ search index=networksessions sourcetype=microsoft:dhcp (Description=Renew OR Description=Assign OR Description=Conflict) earliest=-15min latest=now() | head 1 | return ($IP_Address) ]   ... View more