Try this workaround
your base search | appendpipe [| stats count | eval temp=1|append [ your subsearch ]
| eventstats values(count) as count | where count<50 AND temp!=1]
I have tried this but it doesn't seem to resolve the IPs or show the testIP field when the count is < 50. I have tested the base search and it does work. I will play around with it some more tomorrow.
index=hostcheck "host timed out" | appendpipe [| stats count | eval temp=1 | append [search index=hostcheck "host timed out"| rex max_match=1 "(?i)(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| lookup dnslookup clientip AS testIP]| eventstats values(count) as count | where count<50 AND temp!=1]
index=hostcheck "host timed out" | appendpipe [| stats count | eval temp=1 | append [search index=hostcheck "host timed out"| rex max_match=1 "(?i)(?<testIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"| lookup dnslookup clientip AS testIP]| eventstats values(count) as count | where count<50 AND temp!=1]
Could you provide more information? You have a base search and want to append result of a subsearch only when base search have more than 50 events?
So if it is < 50 events, the rex + lookup should run. if > 50 the rex+lookup shouldn't run...
Yup, you got it.
Try this,
search.... | eventstats count | where count < 50 | do the rex...