How to pass a value from the outer search to the inner subsearch?

[greg]

I'm trying to compose a search like this:

sourcetype=A | eval param=ceil(SomeField) | join Name [search sourcetype=B status<param | sort status | head 1] | table _time, Name, status

but it returns no results.

I guess it's because "param" is not visible (empty) in scope of inner search.
In other words, I want to parametrize the inner search so it could do some filtering over sourcetype B and return a single event to join to main search results.

Is there any way to pass the param value from the outer search to the inner subsearch?
Any help is greatly appreciated.

[Ayn · Accepted solution]

No, the flow is the other way around, with data being available from the subsearch to the outer search.

Subsearches work much like backticks in *NIX environments in that they run first of all and then return their results before the rest of the query is run. I can't tell for sure what you're trying to achieve just by looking at the query, but perhaps you can switch places of the outer search and the subsearch?

[greg]

Thanks for clarification, I'll try to rewrite the search in some other way. Switching places is not the case here.

The problem is the subsearch returns multiple results and join takes only one from the returned set (that looks strange and not like in SQL). I was able to combine the subsearch results into a single event using transaction and get them joined anyway, but then the rest of the search becomes complicated with all these splitting back makemv/mvexpand operators.

It would be much easier to make filtering in the subsearch.