Fields Search Issue

[Phynyte]

what does the syntax look like so I can pull Multiple fields from a subsearch to an outer search?

index=security "An account was successfully logged on." [search index=randomlogs host=employeetermlist20140311 | rex "(?i)^(?:[^,]*,){2}(?P<ADAcctName>[^,]+)" | rex "(?i) .*?,(?P<TermDate>\\d+/\\d+/\\d+)(?=,)" | rename ADAcctName AS Account_Name | table Account_Name TermDate | fields Account_Name TermDate] | eval NewAccount_Name=mvindex(Account_Name, 1) | stats max(_time) by NewAccount_Name | rename max(_time) AS Last_Login | eval Last_Successful_Login=strftime(Last_Login, "%m/%d/%Y") | table NewAccount_Name TermDate Last_Successful_Login

My search works just find without TermDate and I figured out that the problem is with my fields

I tried listed them multiple different ways but it never pulls TermDate out with my Account_Name?

I know it's something easy just not sure what.

[Phynyte]

No term date only exists within the randomlogs search. I just want to pull that field out of the inner search and any account name returned I wanted to match the term date in a table beside it

[somesoni2]

Do the index=security have field named TermDate?

[Phynyte]

Yes the inner search works just fine if executed by itself

[Phynyte]

Yes it does

[antlefebvre]

Check to make sure your extractions are the same case as what you are trying to list. TermDate is not the same as termdate.

[antlefebvre]

I'm guessing your full search is pulling the Account_Name from the security index. Not the randomlogs index. In that case your not actually getting a event matches with the termdate.

[Phynyte]

I updated the search and it's still not working.

index=security "An account was successfully logged on." [search index=randomlogs host=employeetermlist20140311 | rex "(?i)^(?:[^,],){2}(?P[^,]+)" | rex "(?i) .?,(?P\d+/\d+/\d+)(?=,)" | rename ADAcctName AS Account_Name | table Account_Name termdate | fields Account_Name, termdate] | eval NewAccount_Name=mvindex(Account_Name, 1) | stats max(_time) by NewAccount_Name | rename max(_time) AS Last_Login | eval Last_Successful_Login=strftime(Last_Login, "%m/%d/%Y") | table NewAccount_Name termdate Last_Successful_Login