The following example searches for "404" events and appends the fields in each event to the list of host values returned from the incoming search results.

from main 
| fields host 
| appendcols [search 404]

See also