Answer by warren for Assigning a subsearch result to a variable

I would probably do this as separate searches on the dashboard, unless there was an overwhelming need to have it all in one

Alternatively, you could | append each search, & | stats values at the ed like this:

index=ndx sourcetype=srctp "middleware 1" "domain1.tld" userid=*
| stats dc(userid) as domain1users
| append
    [| search index=ndx sourcetype=srctp "middleware 2" "domain2.tld" userid=*
    | stats dc(userid) as domain2users ]
| stats values(*) as *

Then in your <done>...</done> clause, have multiple <set token="...">$results.domain{N}users</set> pairs

from User warren – Stack Overflow https://stackoverflow.com/questions/75888985/assigning-a-subsearch-result-to-a-variable/75890117#75890117
via IFTTT

merikebi

warrenmyers.com