I want to get a value from subsearch assigned to outer search.
I am trying like this
index=OUTER sourcetype=OUTER_ST | eval value = [search index=INNER sourcetype=INNER_ST |eval x=10 |return $x ]
But this gives me
Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression
How to resolve this ?
Because the return value is a string, you can not do it?
How about this?
index=OUTER sourcetype=OUTER_ST | eval value = [search index=INNER sourcetype=INNER_ST |eval x="\"10\"" |return $x ]
does it matter if the inner search is searching a different index than outer search ?
I am still getting
Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression
If the value is numeric, it behaves like a sample.
This error is simply because the sub search result is 0.