Since you didn't provide details of your actual searches, I will use a dummy example. index=foo sourcetype=bar "search text" [search index=bar sourcetype=foo "search string 2" | eval extendedproductcode = "*".productcode | dedup extendedproductcode | table extendedproductcode] This effectively equates to  index=foo sourcetype=bar "search text" ( extendedproducttype="*5556" OR extendedproducttype="*5557" ) SPL is not SQL - it processes a stream of events in a pipeline - each command in the pipeline processes events from the previous command and passes events on to the next command - with subsearches (the command pipeline in square brackets []), the subsearch is processed first so that the result can be used by the outer search ... View more