Subsearch based on parent search

Question

I want to create subsearch based on parent fields search. I want to show only rows from cor_inbox_entry that includes keys.OrderID. (keys.OrderID is substring of fullBodID)

Example for fullBodID : infor-nid:infor:111:APRD00908_2022-09-06T12:01:26Z:?ProductionOrder&verb=Process&event=10545 Example for keys.OrderID : APRD00908

index=elbit_im sourcetype=cor_inbox_entry 
| spath input=C_XML output=bod path=ConfirmBOD.DataArea.BOD 
| xpath outfield=fullBodID field=bod "//NameValue[@name='MessageId']" 
|appendpipe
    [ search "metadata.Composite"=ReportOPMes2LN 
    | search fullBodID = "*".keys.OrderID."*"] 
| table _time, fullBodID

Any idea?

Subsearch based on parent search

0 Answers