SubSearch is not getting the info

[rockym5]

Hi.

I'm trying to use the subsearch, but I'm not what I am doing wrong.

First the inner search is a list of account like this one.

index=main sourcetype=vpacmanagement
|eval DateStamp3= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval MemberName2 = split(TeamMember, "\\")
| eval Member2 = mvindex(MemberName2,1) | eval Member2=upper(Member2)
| where DateStamp3 > relative_time(now(), "-4d") AND like(Status, "%/%/%") AND Member2 = "ADMMICHAEL_HAYES3"
|dedup WONumber | rename Member2 as Member | fields Member

I get one account, all ok so far. But using the search in an outer search.

index=main sourcetype=vpacmanagement|join Member[search index=main sourcetype=vpacmanagement
|eval DateStamp3= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval MemberName2 = split(TeamMember, "\\")
| eval Member2 = mvindex(MemberName2,1) | eval Member2=upper(Member2)
| where DateStamp3 > relative_time(now(), "-4d") AND like(Status, "%/%/%") AND Member2 = "ADMMICHAEL_HAYES3"
|dedup WONumber | rename Member2 as Member | fields Member]
| eval DateStamp2= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval month = strftime(DateStamp2, "%m")
| eval year = strftime(DateStamp2, "%Y")
| eval GroupName = split(DomainGroup, "\\"), MemberName = split(TeamMember, "\\")
| eval Name = mvindex(GroupName,1), Member = mvindex(MemberName,1) | eval RequestType = upper(RequestType), Name = upper(Name), Member=upper(Member)
| where not like(Status, "%/%/%") and DateStamp2 > relative_time(now(), "-2d")
|dedup RequestType,DomainGroup, TeamMember
| fields WONumber, DateStamp, ResourceSteward, RequestType, Name, Member, Status
| table WONumber, DateStamp, ResourceSteward, RequestType, Name,Member, Status | sort DateStamp2

If you see I made some calculation and I'm using Member field as value to make the join, but still is not getting any account from the outer, and in fact the element exists in the outer search, does anyone knows what am I missing?

Thanks

[richgalloway]

The subsearch derived the Member field from TeamMember so it would seem the main search, which uses the same index and sourcetype, would expect a field called "TeamMember" to come from the subsearch.  For a join to work properly, both sides must use the same field name(s).  This can be done using rename in the subsearch.

Run the subsearch by itself with | format appended to see what the subsearch turns into.  That resulting string, inserted into the main search, is what produces the final result set.  Adjust the subsearch (or the join command itself) appropriately to get the results you want.