One way would be to eval your custom value ("abc") along with a delimiting character (like a comma) onto whichever field you want it to became a value of, then use makemv to make your field into a multi-value field and split the new value into two separate values of the field. Something like this: ... your base search ... | myfield=myfield.",abc" | makemv myfield delim="," The . in the eval is just a way of concatenating the values of myfield and ",abc" together. Try this out and see if it accomplishes what you need. ... View more

Your sub search could be timing out before it completes. The default time is 60 seconds, so if your search runs longer than that, it could just be getting killed before it can return results. References: http://docs.splunk.com/Documentation/Splunk/6.1.4/Search/Aboutsubsearches http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Limitsconf Look for the [subsearch] section. ... View more