https://community.splunk.com/t5/Splunk-Search/Why-does-subsearch-always-have-zero-results/m-p/646739#M223855 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/257399">@Lavani</a>&nbsp;</P><P>Please run only the subsearch part on the production and see if it gives any output:</P><LI-CODE lang="markup">| rest /services/authentication/users | table roles title | rename title as userName,roles as role | mvexpand role | search role="logmon_app*" </LI-CODE><P>&nbsp;</P> Tue, 13 Jun 2023 04:02:07 GMT inventsekar 2023-06-13T04:02:07Z https://community.splunk.com/t5/Splunk-Search/Why-does-subsearch-always-have-zero-results/m-p/646736#M223852 <P><SPAN>Hello Everyone.</SPAN></P> <P><SPAN>I have a search with a subsearch that's correctly running on a test environment (Splunk 8.2.9).&nbsp;Now I copied it on a production environment (Splunk 82.9), but it doesn't run: the subsearch has always zero as result.</SPAN></P> <P>&nbsp;</P> <P>| rest /services/authorization/roles/<BR />| search title="logmon_app*" | table title<BR />| rename title as role<BR />| join type=left role max=0<BR />[| rest /services/authentication/users<BR />| table roles title<BR />| rename title as userName,roles as role<BR />| mvexpand role | search role="logmon_app*" ]<BR />| stats values(userName) as username by role | eval rolepresent="yes"<BR />| outputlookup logmon_roles_users.csv override_if_empty=false,</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>Thank you&nbsp;</P> Tue, 13 Jun 2023 14:21:16 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-subsearch-always-have-zero-results/m-p/646736#M223852 Lavani 2023-06-13T14:21:16Z https://community.splunk.com/t5/Splunk-Search/Why-does-subsearch-always-have-zero-results/m-p/646739#M223855 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/257399">@Lavani</a>&nbsp;</P><P>Please run only the subsearch part on the production and see if it gives any output:</P><LI-CODE lang="markup">| rest /services/authentication/users | table roles title | rename title as userName,roles as role | mvexpand role | search role="logmon_app*" </LI-CODE><P>&nbsp;</P> Tue, 13 Jun 2023 04:02:07 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-subsearch-always-have-zero-results/m-p/646739#M223855 inventsekar 2023-06-13T04:02:07Z