While this would work, a subsearch is something that you should avoid if there's a decent alternative, which in this case is given in David [Splunk]'s answer.
The reasons to avoid subsearches are many, but most obviously, there's a limit to the number of results that a subsearch can return, and in this case, it turned out highly inefficent due to the extensive results of the subsearch.
... View more