Now I want to join it with a CSV file with the following format. bluray. The format command changes the subsearch results into a single linear search string. A subsearch does not remove fields/columns from the primary search. key"="Application Owner" "tags {}. Second Search. Browse to the View Settings section and place a check next to Allow view assignments (WebClock only) . I believe that unless you specify earliest and latest, subsearches are run over the time range chosen in the time picker, but will only run for as long as the maxtime setting in limits. The subsearch passes fields into your main search that are dynamically changing, so the results could be different each time main search is ran. Used with TimeClock Plus v7, SubSearch Plus lets substitutes receive and take action on substitute requests from multiple school districts at once. Prism HR Community. [search index=ast sourcetype=poc_agi_logs agi_dnid=* grp=* earliest=-1y latest=-1d |stats count as "HWM" |eventstats allnum=true max ("HWM") AS "High Water Mark"] That said, I thought the search in my answer was doing. For substitutes, the SubSearch Plus app provides convenient notifications to substitutes from all of the districts that are registered with. SubSearch Plus is a powerful new tool to track substitute needs…Lataa Hakutoiminto Tekstityksille. I am hoping someone can help me with a date-time range issue within a subsearch. Employee Vendor Conflict of Interest. 0 Karma Reply. Use the following procedure to add hours within Mass Hours. I have done the required changes in limits. SubSearch Plus; HR Employee Exit Form; Employee Vendor Conflict of Interest; Request for Public Records; Certified Employment Application; District White Fleet Vehicle Request Form; District White Fleet Driver Checklist; Continental School District #39 On-Site Learning Opportunities and Support Services; The Trust COVID School Waiver. " in. A subsearch looks for a single piece of information that is then added as a criteria, or argument, to the primary search. This enables the Hours field and allows you to enter in a segment length. TimeClock Plus SubSearch Demo The SubSearch Demo is scheduled for March 15 at 10:00 a. So you may get the part of. Ultra Champion 01-23-2020 04:34 AM. | multisearch [search source1] [search source2]. Searching HTTP Headers first and including Tag results in search query. The result of the subsearch is then used as an argument to the primary, or outer, search. I want to perform a search where I need to use a static search string + input from a csv file with usernames: Search query- index=someindex host=host*p* "STATIC_SEARCH_STRING" Value from users. Used with TimeClock Plus v7, SubSearch Plus lets substitutes receive and take action on substitute requests from multiple school districts at once. join. 4581 ext. Reduced Price: $0. If you can corelate on a particular field (and I can see you want to use PURCHASEID for this), use either selfjoin, transaction or even simple stats to group your. o WebClock: Employees can now view their accrual ledgers. Subsearches are enclosed in square brackets within a main search and are evaluated first. By default, each. Hi @jwhughes58, You can simply add dnslookup into your first search. True. 8" | eval aatest=`test_dnshost (ip)`. The command above works without lookup definition for example. All you need to use this command is one or more of the exact. URL Name. To enable SubSearch for substitutes, browse to Configuration > Other Configurations > Clock Configurations, and choose or create a clock configuration that substitutes will exclusively be using. And Table_B is changed to Table_A field with using "alias" feature of "return" command. Try a subsearch. 3) Subsearches must be enclosed in square brackets and must start with a Generating command (eg: search, makeresults etc. Substitute Teacher Subsearch Plus. Limitations on the subsearch for the join command are specified in the limits. sourcetype=log_layer_2 source=log. (B) Large. If the software includes SubSearch Plus, choose a substitute job code for this job code using the drop-down menu (which includes all job codes entered into the software). The problem is I want to list out the filename and the keyword that matched in the filename. ). In my case, I need to use each result of subsearch as filter BUT as "contains" and not "equal to". b) Multiple searches can be used. Your subsearch needs to start with some form of event-generating command. This is a powerful suite of tools that saves users time, but it must be used with care to ensure that operations only add, edit, or delete the correct segments. High-quality, interactive online courses are taught by appropriately-certified teachers and allow for. If using | return $<field>, the search will return: - All values of <field> as field-value pairs. com . Builder. Ah I see - that is a better way to address the problemSolution. A subsearch must be enclosed in square brackets. You can use subsearches to correlate data and evaluate events in the context of the whole event set, including data across different indexes or Splunk Enterprise servers in a distributed environment. org. If you can't get the format output right, you may have to use the old method without IN. , True or False: If a transaction fails to meet any conditions, it is evicted from the results. I need to return all rows from my top search but add a count of rows from a map or subquery/subsearch. In that case you can do the search like this. The strange thing is that both the searches run correctly by themselves, but when together the subsearch has always zero results. I explored several other functions in an attempt to achieve the desired result, but none of them yielded the data I was looking for. Audit Log: TimeClock Plus keeps a meticulous record of any modifications made to the information contained within. Then, using the AS keyword, the field that represents these results is renamed GET. | where src IN ( [MySubSearch]) It did not work. src_user All_Email. This example uses eval expressions to specify the different field values for the stats command to count. If the result makes sense in the context of the main search then you're OK; otherwise, adjust the subsearch to produce working results. eval c. 0), but it doesn't run: the subsearch has always zero as result. Phone: 520-625-4581. The inputlookup command is a command to list the contents of a lookup. ACCEPTING ASSIGNMENTS 1. Toggle SideBar. Which command uses a template subsearch to replace the values of specific fields? foreach replace eval none; commands only use functions to replace field values, not templates or subsearches foreach True or False: eventstats and streamstats support multiple stats functions, just like stats. Subsearch is a search query that is nested within another search query, and the results of the subsearch are used to filter the main search, so: 1- First, run a query to extract a list of fields that you want to use for filtering your subsequent Splunk query: index=my_index sourcetype=my_sourcetype | table my_field. I know you can use a search with format to return the results of the subsearch to the main query. none; commands only use functions to replace values, not templates or subsearches. School Phone: (520) 625-4581 x7420. index=firewall src_ip=* [ | makereults | eval src_ip=1. Second Search (For each result perform another search, such as find list of vulnerabilities. Click the card to flip 👆. Appending. Main search data exists , Title 2 will return a dummy value (NoTitle2) , still Title2 will be listed in Selected Fields , so that it can be used further. Let's find the single most frequent shopper on the Buttercup Games online. Baixe SubSearch Plus e divirta-se em seu iPhone, iPad e iPod touch. 1) Index=test event=initiated | dedup ip-address | table ip-address gives me the initiated transactions. Due to limitation, the join command will only return a maximum of 50,000 results to perform the join. Business TCP Humanity. Download SubSearch Plus and enjoy it on your iPhone, iPad and iPod touch. Business WhenToWork Employee Scheduling. 30 for breakfast and $. TimeClockPlus. With just a few clicks on a computer or. There are no 1 to 1 field mappings between the data sets so there is some renaming involved but I don't this should impact the end result. TCP Software’s substitute management tools are designed with a simple goal in mind: automate time-consuming processes to free up your administration. Click the blue Save button in the lower right corner. SubSearch Plus is Free Business app, developed by Data Management Inc. For more information about when to use the append command, see the flowchart in the topic About event grouping and correlation in the Search Manual. The single piece of information might change every time you run the subsearch. You can see this in the remote search section of the job inspector. The search command is processing the results from 1st_index. which seems to expand with "ip" as an argument value, not the actual field content:SubSearch Plus is a powerful tool to track substitute needs in the same flexible and easy to use environment your administrators and employees already use for time and attendance. The SubSearch Plus mobile app enables you to view, accept or reject substitute assignments on the go. Limitations on the subsearch for the join command are specified in the limits. If the user failed to authenticate, then it gives the public IP. map is powerful, but costly and there often are other ways to accomplish the task. Or call 520-625-4581 For More Information! Returning Student Enrollment Registration for the 2023-2024 School Year is now available. 2. ‎Used with TimeClock Plus v7, SubSearch Plus lets substitutes receive and take action on substitute requests from multiple school districts at once. Subsearch results are combined with an ____ Boolean and attached to the outer search with an ____ Boolean. Download SubSearch Plus for Android to used with TimeClock Plus v7, SubSearch plus lets substitutes receive and take action on substitute requests from multiple school. ; Enter NONE as the break type so the shift ends with this segment. 7301. Anagrams [edit] subchaser(OK) Video Games Plus (VA) Oldskool Video Games and More (OK) ThrillHouse Games (VA) DawnStar Video Games (OR) Final Form (WA) Pink Gorilla Games (OR) TOTL. 168. Estimated number of the downloads is. The `AND` operator is used to combine the subsearch results, ensuring that both the conditions from the subsearch and the conditions from the outer search must be satisfied for a record to be included in the final result set. Motivator. Then, click the blue Manage button, and click Edit to access the Edit Segment window. Develop job-relevant skills with hands-on projects. Users can set different notification thresholds, and subs can mark themselves as unavailable. •Employees using Namely Time can easily clock in and out with a streamlined interface. In this section of of Splunk tutorial you will learn the lookup tables recipes, like to benefit reverse lookup, using an two-tiered lookup, using multistep lookup, creating a lookup table from search results, real more. P a g e | 2 6. Event 20274 is when a user successfully authenticates with a RADIUS server. K-8). The Killer (2023) The. Change the argument to head to return the desired number of producttype values. SubSearch Essentials. 98 hostName1 58. Continental Elementary School Athletics. Specify the amount of time by using a number and a time unit. 3. But it's not recommended to go beyond 10500. Substitute Teacher Subsearch Plus. Trending Articles. 7. Ive been making some headway on this query, not totally there yet however. With subsearches fetching this filter condition it can be used either of following ways:-. Continental School has served the community of Green Valley since the early 1900's. To see what the substitution is, run the subsearch with | format appended. SAN ANGELO, Texas, May 21, 2019 /PRNewswire/ -- TimeClock Plus announced today the release of their newest product offering SubSearch Plus, a purp. When you use a subsearch, the format command is implicitly applied to your subsearch results. 500 | fields earliest,latest ] There's no need for an if, as the conditional logic is implicit in your selection of looking for events containing MOVE. 697, was released on 2019-05-15 (updated on 2019-10-25). Your coverable employees can request specific substitutes and select a list of preferred subs. conf file. SubSearch Plus is a powerful tool to track substitute needs in the same flexible and easy to use. 82. 4581 ext. Visit: New Student Registration. Appends subsearch results to current results. SubSearch Plus is a powerful new tool to track substitute needs in the same. Press Control-F (e. Home Home; Release Notes SubSearch Plus is Free Business app, developed by Data Management Inc. Green Valley, AZ 85614 Phone: 520-625-4581. Hello, I would like to run a scheduled report once. SubSearch Plus is a powerful new tool to track substitute needs… How subsearches work. 3. From that subsearch I collected the callId. Description: Options to the join command. 1080p. a) Great for filtering data. Below command is working fine for me. PUBLIC ARTICLES HELP GUIDES HOW TO GUIDES. SubSearch Plus is a powerful new tool to track substitute needs… The combination of subsearch results with the outer search typically involves boolean operators. On the Companies tab, find the school district you would like to receive notifications and assignments for and tap Accept. I recommend you have a read of the documentation on subsearch. An example of both searches is included below: index=example "tags {}. v7 GT-400 Handscanner Setup. When you specify single time amounts, the number is implied. Passing parent data into subsearch. SubSearch Plus Notification App used with TimeClock PlusDownload SubSearch Plus and enjoy it on your iPhone, iPad and iPod touch. First, the subsearch is run which returns a couple of. Go back to the list on the left-hand side, and check the employee who will work as a substitute. The fields or values for the fields "src_ip" and. This app had been rated by 4 users. If you need to enrich the results of a search, using the contents of a lookup, you have to use the lookup command. The append command runs only over historical data and does not produce correct results if used in a real-time search. . b) last, search query. Critical Features: Features that TimeClock Plus cannot operate without, such as job codes, hours, and employees. Download SubSearch Plus and enjoy it on your iPhone, iPad and. I cannot use "timewrap" option in my query as I don't want to wrap the results either with hrs/days/weeks/Months. You should get results that look a bit like this: ( (user=foo time1=bar) OR (user=foo2 time1=bar2) OR (user=foo3 time1=bar3)) When that is. SubSearch Plus This feature authorizes employees to request specific substitutes while providing them with a list of preferred substitutes. When you enroll in this course, you'll also be enrolled in this Specialization. Login SUBSEARCH. TrademarkElite is the U. The SubSearch Plus app is a companion to the SubSearch Plus feature in TimeClock Plus. Subsearches are enclosed in square brackets within a main search and are evaluated first. max. Title. Integrating the two features r the amount of work for the teachers and the administrators alike. Related Articles. True or False: eventstats and streamstats support multiple stats functions, just like stats. To be prepared for the start of learning on Monday, August 10, 2020, please take some time to read our back to school Digital Learning Expectations. . 21 p/each Monthly Time and Attendance SaaS TimeClock Plus TimeClock Plus Professional Monthly Clockable Employee License 1025-12011 $5. 00 25. The SubSearch Plus app is a companion to the SubSearch Plus feature in TimeClock Plus. conf. You don't have a subsearch in your query. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. - The 1st <field> value. 4581 ext. •An offline mode allows employees to use Namely Time in remote locations. How subsearches work. For example, if the Time Range Picker is set to Last 7 days and a subsearch contains earliest=2d@d, then the earliest time modifier applies only to the subsearch and Last 7 days applies to the base search. It's worth checking what your subsearch results look like. o SubSearch Plus: All accepted sub assignments are now visible to the substitute. Certified Employment Application. spec file. BUSINESS OFFICE. 1. It’s such a basic command that you don’t even need to type it anywhere before the first pipe, because it is invoked implicitly at the head of a search, retrieving events from the indexes on disk. Use these commands to append one set of results with another set or to itself. 625. [ search [subsearch content] ] example. i'm trying to use results from a subsearch to feed a search, however; 1) subsearch is results of a regex pullWhen you use a subsearch, the format command is implicitly applied to your subsearch results. Document fields. 2. Learn more. 09-16-2010 07:40 PM. SubSearch Plus enables teachers to manage substitute requests using TimeClock Plus v7's leave management features. Again, click the Access tab and expand the Provisioning section. After the searching, it should be tabled to display the fields "timestamp" "src_ip" "dst_ip" "hostname" "message". The subsearch does return a table of the sources I want but the main search then makes a table of lots of sources that I. index=main [makeresults count=1 | eval field=value] What Splunk eventually searches for after executing the subsearch is, explicitly written: index=main (field=value) This is because the results of the subsearch are automatically used as search criteria. , The _____ command combines results from two or more datasets and returns a single result set. "search this page with your browser") and search for "Expanded filtering search". , True or False: If there is an appendpipe in a search, its subpipeline will always be executed last. Once your Search Term Report has been created, you will see the screen below. For over 28 years, TimeClock Plus has been a chief in real-time employee time and attendance tracking. My goal is to create a dashboard where you enter a date-time range (either from a time picker or something like the last 15 minutes), and then have it retrieve results for the current search as well as the same time range. Hours: Type the number of hours worked by the employee into the field. It also provides a quick overview of assignments already accepted on any given day. ; Select a job code from the drop-down menu labeled Job Code. Expanded index search = (| makeresults) Which means that you will be searching for literal pipe character and "makeresults" word. Here are step-by-step instructions to get it set up in TimeClock Plus. In one of my searches, i am running a subsearch that searches a lookup table based on the token and returns corresponding values back to the main query. The most common use of the OR operator is to find multiple values in event data, for example, “foo OR bar. The application allows you. Notably, it avoids problems that may occur in the special-case of "No results found", which otherwise can confuse the visualization rendering. Benefit #2 – Better Event Recognition: By leveraging subsearches, searches can be created to gain a comprehensive view of their data relationships and dependencies. Registration is now open for the 2023-2024 School Year. multiple joins and subsearch question. Lunch Service - 10:30 a. 625. A subsearch looks for a single piece of information that is then added as a criteria, or argument, to the primary search. Download SubSearch Plus and enjoy it on your iPhone, iPad and iPod touch. The SubSearch Plus app allows substitutes to view and accept assignments across multiple school districts. One more tidbit. To approve a. A subsearch returns no more than 10,000 events. . A very log time search, I don't care about performance or time to complete. | lookup <lookup-table-name> <lookup-field>. Appends subsearch results to current results. If you specify more fields with the fields command, those are brought through as ANDed key-value pairs, with an. SubSearch Plus (In Beta): SubSearch Plus is a tracking tool for coverable employees. appendcols. Plus it's more uniform and, as a result, easier to work with. Your children may qualify for free meals or for reduced-price meals. You can contact Steve Lathen, Athletics Director, at (520) 625. For example current results from each search when run independently looks as follows: First Search. District White Fleet Vehicle Request Form. SubSearch Instructions. OUTPUT. Your subsearch in this case will be the datamodel search index=firewall_logs signature=* [| datamodel search that returns dest_ip | fields dest_ip | rename dest_ip as signature | format] | more searching. Used with TimeClock Plus v7, SubSearch Plus lets substitutes receive and take action on substitute requests from multiple school districts at once. The SubSearch Plus app is a companion to the SubSearch Plus feature in TimeClock Plus. The "inner" query is called a 'subsearch' and the "outer" query is called the "main search". 6 Release Notes This release contains several bug fixes and minor enhancements in addition to the features listed below: New Features SubSearch Plus (In Beta): SubSearch Plus is a tracking tool for coverable employees. Description: Specifies the maximum number of subsearch results that each main search result can join with. We will celebrate our 25th Wedding Anniversary in January 2021. index=bar <search criteria> | eval time1=_time | table user time1 | format. 4. still I am seeing the message "[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000. Solved! Jump to solutionThe only exception to this is self-carry epi-pens or inhalers. Approving Shifts . Think instead of gathering all the data you need at once, and then reducing it to the statistics that you want. This is the subsearch above that was throwing me off, because it just gets a total count of events over the past year. Reveal Math K–5 An Elementary Core Math Curriculum. Gain a foundational understanding of a subject or tool. I have not tried to modify it to greater value but if its not working then need to think of something else. This provides power capabilities for correlating events across multiple data sources. Used with TimeClock Plus v7, SubSearch Plus lets substitutes receive and take action on substitute requests from multiple school districts at once. key, startDate, endDate, internalValue. The first clause uses the count () function to count the Web access events that contain the method field value GET. Study with Quizlet and memorize flashcards containing terms like Which command uses a template subsearch to replace the values of existing fields? a. 30. If my search looks like this now; index=my_index field1=abc field2=def field3!=aaa field3!=bbb field3!=ccc field3!=ddd field3!=eee field3!=fff Is there a way to use an inputlookup table search to rewrite the search?. a) TRUE. 1 that when you modify the _time field in a subsearch it may not return all the events you expect from the subsearch. Hi Splunk friends, looking for some help in this use case. 1. Subsearch options: maxtime. You use a subsearch because the single piece of information that you are looking for is dynamic. A subsearch takes the results from one search and uses the results in another search. The SubSearch Plus app is a companion to the SubSearch Plus feature in TimeClock Plus. When present in a search pipleine, a subsearch is executed _____ and it sends its _____ to the basic search. T. TimeClock Plus® Cloud offers the best value for most customers. 30. In this case, the subsearch will generate something like domain2Users. so the resulting search would become (sample) index=_internal (sourcetype=splunkd OR sourcetype=splunkd_access) Same this if you reduce the result. o SubSearch Plus: All accepted sub assignments are now visible to the substitute. The SubSearch Plus app is a companion to the SubSearch Plus feature in TimeClock Plus. For substitutes, the SubSearch Plus app provides convenient notifications to substitutes from all of the districts that are registered with. K—8th Grade. Pre K—8th Grade. Notice the "538" which is the first result returned in the EventCode field in the subsearch. SubSearch Plus (In Beta): SubSearch Plus is a tracking tool for coverable employees. Now I copied it on a production environment (Splunk 7. 840. 3 Karma. foreach b. Splunk Answers. csv where the list is like this- Please note that User/UserList is NOT a field in my Splunk: **UserList** User1 User2 User3 . Syntax: type= (inner | outer | left) | usetime= | earlier= | overwrite= | max=. Subsearches are always executed first. The means the results of a subsearch get passed to the main search, not the other way around. I used a subsearch because I need to find the records that has a fractionLost > 128 for eh_event=RTCP_MESSAGE. For example, the first subsearch result is merged with the first main result, the second subsearch result is merged with the second main result, and so on. spec file. BrowseSubSearch Plus is a powerful tool to track substitute needs in the same flexible and easy to use environment your administrators and employees already use for time and attendance. Time in: Enter the date and time the employee worked into the two fields to the right. append Description. the lookup command is a join betweeen the main search and the lookup, using the defined key. So let's look at your example, tearing it down into a couple of pieces:[subsearch] # maximum number of results to return from a subsearch maxout = 100000 but the job inspector says: INFO: [subsearch]: Subsearch produced 255526 results, truncating to maxout 50000. Used with TimeClock Plus v7, SubSearch Plus lets substitutes receive and take action on substitute requests from multiple school districts at once. A subsearch looks for a single piece of information that is then added as a criteria, or argument, to the primary search. This allows you to pull specific data. SubSearch Plus is a powerful new tool to track substitute needs…05-26-2011 05:12 PM. and more. I tried different ways of converting to epoch time and back but didn't get anywhere with that either. Please see the substitute teacher checklist and directions for utilizing our SubSearch Plus. Post Reply Related Topics. Append the fields to the results in the main search. I need to gather info based on a field that is the same for both searches "asset_uuid". In the simplest example of eval, to set a field to a specific string value, you must do: So, I had to add in an additional eval within each subsearch to make sure the string coming out of it was surrounded by quotes -- otherwise it will not work. Appends the fields of the subsearch results to current results, first results to first result, second to second, and so on. Mass Hours, a feature new to TimeClock Plus, allows users to add, edit, and delete segments for multiple employees. [ search [subsearch content] ] example. Family Information: I was born and raised in Adams County, Ohio, and lived in both Ohio and Kentucky before moving to Arizona in January 2017. In addition, our annual financial report for the school year beginning July 1 through. 10-21-2015 07:57 AM. Beinga subsearch, they run first and their results get inserted into the main search exactly where they are. Download SubSearch Plus and enjoy it on your iPhone, iPad and iPod touch. Change the format of subsearch results. The SubSearch Plus app is a companion to the SubSearch Plus feature in TimeClock Plus. I need to display active transactions. The SubSearch Plus app is a companion to the SubSearch Plus feature in TimeClock Plus. SubSearch Plus; HR Employee Exit Form; Employee Vendor Conflict of Interest; Request for Public Records; Certified Employment Application; District White Fleet Vehicle Request Form; District White Fleet Driver Checklist; Continental School District #39 On-Site Learning Opportunities and Support Services; The Trust COVID School Waiver. For assistance, please call Customer Support at (325) 223-9300. In this example, the query within brackets (the subsearch) fetches your product types. Please read the following statements and sign form I have examined the vehicle identified above and agree there is no damage other than that indicated below. I cant seem to get it to return the bytes in / bytes out in the results with the session IDs, its looking at one group of alerts for the username and session, and the subsearch is telling the top search what sessions to look for, but I cant seem to pass the bytes_in/bytes_out. Subsearch is an automated subtitle downloader and extractor that allows users to search and download subtitles for movies and TV shows with a single click from the context menu. But, what is weird, is that the command below did work correctly. 0 Karma Reply. Employee Email. Request for Public Records. I understood that, thats the result returned from my second subsearch attempt, I was asking about the difference between between your working result, and my first subsearch attempt. Note: Enter a note for the segment if necessary. SubSearch Plus; HR Employee Exit Form; Employee Vendor Conflict of Interest; Request for Public Records; Certified Employment Application; District White Fleet Vehicle Request Form; District White Fleet Driver Checklist; Continental School District #39 On-Site Learning Opportunities and Support Services; The Trust COVID School Waiver. Appends the fields of the subsearch results to current results, first results to first result, second to second, and so on. This is used when you want to pass the values in the returned fields into the primary search. SubSearch Plus; HR Employee Exit Form; Employee Vendor Conflict of Interest; Request for Public Records; Certified Employment Application; District White Fleet Vehicle Request Form; District White Fleet Driver Checklist; Continental School District #39 On-Site Learning Opportunities and Support Services; The Trust COVID School Waiver. The application features a graphical user interface for configuring settings, including options for searching subtitles in 70 different languages from various subtitle. 4581. O. Breakfast costs $1. These logs are accessible in case you need to audit your edit records, or view a previous record in case of an accidental edit. append. SubSearch Plus; HR Employee Exit Form; Employee Vendor Conflict of Interest; Request for Public Records; Certified Employment Application; District White Fleet Vehicle Request Form; District White Fleet Driver Checklist; Continental School District #39 On-Site Learning Opportunities and Support Services; The Trust COVID School Waiver. 1. You use a subsearch because the single piece of information that you are looking for is dynamic. In other words there a problem on the second search only when executed in subsearch. All you really need is the subsearch is.