Why are you using a subsearch by itself? Use a search. Not that it really matters since you can't use a search (or subsearch) query in an eval. The eval element requires an eval expression such as "\"blah\"'.
--- If this reply helps you, an upvote would be appreciated.
According to the documentation which I linked in my original post, the <eval> tag's contents behave the same as the eval SPL command with a small list of differences. This list of differences does not include the inability to use subsearches.
If you click the link I included, it brings you right to the section which mentions this but I've nevertheless pasted it below for your convenience.
If the documentation is not true, it should be updated.
The dashboardevalexpression has the same syntax and semantics as theevalexpression syntax for SPL queries. Most of the sameevalexpression functionality is the same between the dashboardevalexpression and the SPL version ofeval. However, there are some important exceptions.
evalexpression functions with different behavior for dashboards
relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.
To learn more aboutevalexpression functions, seeevalinSearch Reference.