what does the syntax look like so I can pull Multiple fields from a subsearch to an outer search?
index=security "An account was successfully logged on." [search index=randomlogs host=employeetermlist20140311 | rex "(?i)^(?:[^,]*,){2}(?P<ADAcctName>[^,]+)" | rex "(?i) .*?,(?P<TermDate>\\d+/\\d+/\\d+)(?=,)" | rename ADAcctName AS Account_Name | table Account_Name TermDate | fields Account_Name TermDate] | eval NewAccount_Name=mvindex(Account_Name, 1) | stats max(_time) by NewAccount_Name | rename max(_time) AS Last_Login | eval Last_Successful_Login=strftime(Last_Login, "%m/%d/%Y") | table NewAccount_Name TermDate Last_Successful_Login
My search works just find without TermDate and I figured out that the problem is with my fields
I tried listed them multiple different ways but it never pulls TermDate out with my Account_Name?
I know it's something easy just not sure what.
No term date only exists within the randomlogs search. I just want to pull that field out of the inner search and any account name returned I wanted to match the term date in a table beside it
Do the index=security have field named TermDate?
Yes the inner search works just fine if executed by itself
Yes it does
Check to make sure your extractions are the same case as what you are trying to list. TermDate is not the same as termdate.
I'm guessing your full search is pulling the Account_Name from the security index. Not the randomlogs index. In that case your not actually getting a event matches with the termdate.
I updated the search and it's still not working.
index=security "An account was successfully logged on." [search index=randomlogs host=employeetermlist20140311 | rex "(?i)^(?:[^,],){2}(?P