Hello @NanSplk01, If it is only the actions field that you're interested in the subsearch, you don't need to perform all of the other operations. But since you're using splunk_server=* in the second search, here's something that might help you. | rest /servicesNS/-/-/saved/searches
| search title=kafka*
| rename dispatch.earliest_time AS "frequency", title AS "title", eai:acl.app AS "app", next_scheduled_time AS "nextRunTime", search AS "query", updated AS "lastUpdated", action.email.to AS "emailTo", action.email.cc AS "emailCC", action.email.subject AS "emailSubject", alert.severity AS "SEV"
| eval severity=case(SEV == "5", "Critical-5", SEV == "4", "High-4",SEV == "3", "Warning-3",SEV == "2", "Low-2",SEV == "1", "Info-1")
| eval identifierDate=now()
| convert ctime(identifierDate) AS identifierDate
| table identifierDate title lastUpdated, nextRunTime, emailTo, query, severity, emailTo
| fillnull value=""
| sort -lastUpdated
| join type=left title [
| rest "/servicesNS/-/-/saved/searches" timeout=300 splunk_server=*
| search disabled=0 AND title="kafka*"
| fields title actions splunk_server
| stats values(actions) as actions by title splunk_server] Let me know if this helps your use case. Thanks, Tejas. --- If the solution works, an upvote is appreciated..!!
... View more