You can actually work around this, but you need to know that when an inner search returns a field named search , that value will be dropped in directly where the subsearch is. So this should work:
index=main eventtype=bad_traffic | eval contactlist = [| whois src_ip | search attribute=*.contact.name | stats values(value) as contacts | eval search="\"".mvjoin(contacts, ",")."\"" ] | table src_ip, errormsg, contactlist
The quote fun in search="\"".mvjoin.. surrounds the list of contacts with double quotes, so that eval knows it's setting the field to a string.
... View more