SubSearch is not getting the info

rockym5 — Tue, 09 Apr 2024 15:57:25 GMT

Hi.

I'm trying to use the subsearch, but I'm not what I am doing wrong.

First the inner search is a list of account like this one.

I get one account, all ok so far. But using the search in an outer search.

index=main sourcetype=vpacmanagement|join Member[search index=main sourcetype=vpacmanagement |eval DateStamp3= strptime(DateStamp, "%Y-%m-%d %H:%M:%S") | eval MemberName2 = split(TeamMember, "\\") | eval Member2 = mvindex(MemberName2,1) | eval Member2=upper(Member2) | where DateStamp3 > relative_time(now(), "-4d") AND like(Status, "%/%/%") AND Member2 = "ADMMICHAEL_HAYES3" |dedup WONumber | rename Member2 as Member | fields Member] | eval DateStamp2= strptime(DateStamp, "%Y-%m-%d %H:%M:%S") | eval month = strftime(DateStamp2, "%m") | eval year = strftime(DateStamp2, "%Y") | eval GroupName = split(DomainGroup, "\\"), MemberName = split(TeamMember, "\\") | eval Name = mvindex(GroupName,1), Member = mvindex(MemberName,1) | eval RequestType = upper(RequestType), Name = upper(Name), Member=upper(Member) | where not like(Status, "%/%/%") and DateStamp2 > relative_time(now(), "-2d") |dedup RequestType,DomainGroup, TeamMember | fields WONumber, DateStamp, ResourceSteward, RequestType, Name, Member, Status | table WONumber, DateStamp, ResourceSteward, RequestType, Name,Member, Status | sort DateStamp2

If you see I made some calculation and I'm using Member field as value to make the join, but still is not getting any account from the outer, and in fact the element exists in the outer search, does anyone knows what am I missing?

Thanks

Re: SubSearch is not getting the info

richgalloway — Tue, 09 Apr 2024 16:46:06 GMT

The subsearch derived the Member field from TeamMember so it would seem the main search, which uses the same index and sourcetype, would expect a field called "TeamMember" to come from the subsearch. For a join to work properly, both sides must use the same field name(s). This can be done using rename in the subsearch.

Run the subsearch by itself with | format appended to see what the subsearch turns into. That resulting string, inserted into the main search, is what produces the final result set. Adjust the subsearch (or the join command itself) appropriately to get the results you want.

topic SubSearch is not getting the info in Getting Data In

SubSearch is not getting the info

Re: SubSearch is not getting the info