Hello Splunksters, I'm new to Splunk and am constructing my first subsearch.  I've read the documentation on subsearches, but am apparently missing something fundamental.  I have a log file that captures and records events based on a GUID.  Obviously GUIDs aren't something one goes searching for directly.  The primary search is by phone number.  So, I need to accept a phone number, retrieve the associated GUID and then return all the results tied to that GUID.  I have the search retrieving the GUID working, and want to use that as the subsearch. Ultimate search I wish to run: index="myIndex" sourcetype="mySourceType" 7c10cfbc-6892-4590-a05c-c12acf16932b   Search retrieving GUID (this works): index="myIndex" host="myHost" sourcetype="mySourceType" <phoneNumber> | rex field=_raw "(?<GUID>\].*$$)" | rex field=GUID "(?<GUID>[^NAME]+)" | eval GUID=replace(GUID, "]", "") | rex field=GUID mode=sed "s/(^\s+)|(\s+$)//g" | dedup GUID | table GUID   What I thought the subsearch should look like: index="myIndex" sourcetype="mySourceType" [search index="myIndex" host="myHost" sourcetype="mySourceType" <phoneNumber> | rex field=_raw "(?<GUID>\].*$$)" | rex field=GUID "(?<GUID>[^NAME]+)" | eval GUID=replace(GUID, "]", "") | rex field=GUID mode=sed "s/(^\s+)|(\s+$)//g" | dedup GUID | table GUID] Everything in the [] returns the GUID, as I understand the doc, that should be what is searched for in the main search.  What am I missing? Thank you! Brian ... View more