https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447730#M126899 <P>what is the logic of the result that you are expecting? are you expecting to see only the common ones between File1.log and File2,log ? you can try using set intersect here, which should get you only the common entries.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Set">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Set</A></P> Thu, 15 Aug 2019 13:07:33 GMT vinaypradhan 2019-08-15T13:07:33Z https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447727#M126896 <P>Query is:<BR /> index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input | rex ".<EM>]*Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | eval ID = "</EM>" + ID + "*" | return $ID ]</P> <P>It returns the results for ID='2138536' (2 events as expected) but also returns additional events (5 more message events) for other IDs.</P> <P>Please advise if there is anything wrong with the query.</P> Wed, 30 Sep 2020 01:44:30 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447727#M126896 vivek991985 2020-09-30T01:44:30Z https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447728#M126897 <P>Corrected:</P> <P>index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input | rex ".]Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | eval ID = "" + ID + "" | return $ID ]</P> Thu, 15 Aug 2019 07:12:47 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447728#M126897 vivek991985 2019-08-15T07:12:47Z https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447729#M126898 <P>Run the subsearch by itself to see what results it produces. Those results will be what the main search looks for so make sure they are correct before continuing.</P> Thu, 15 Aug 2019 12:54:19 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447729#M126898 richgalloway 2019-08-15T12:54:19Z https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447730#M126899 <P>what is the logic of the result that you are expecting? are you expecting to see only the common ones between File1.log and File2,log ? you can try using set intersect here, which should get you only the common entries.<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Set">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Set</A></P> Thu, 15 Aug 2019 13:07:33 GMT https://community.splunk.com/t5/Splunk-Search/splunk-query-with-sub-search-not-returning-the-desired-results/m-p/447730#M126899 vinaypradhan 2019-08-15T13:07:33Z