How do I match two fields from the same join command?

[matthew_foos]

Splunkers,

Search String:

admon-user-lookup-update

| eval src_user = (cn) 
| fields src_nt_domain, displayName, cn
| rename cn as user 
| join user 
    [ search index=winevents (EventCode=630 OR EventCode=4726 OR Eventcode=4720 OR EventCode=4725) dest_nt_domain="xxxx" 
    | fields user, action, ComputerName, EventCode, EventCodeDescription, src_user, status]

I am able to match "cn" with user to produce a display name correlation between userid and full name.. How can I match src_user to use display name as well?

[woodcock]

If you will show a minimal set of sample events and the desired result, I will answer your question. I do not at all understand the way that you have explained your problem but I am certain that it is solvable.

[mstjohn_splunk]

Hi @matthew.foos ,

Did the answer below solve your problem? If so, please resolve this post by approving it!

If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[felipesewaybric · Accepted solution]

Unfortunately, the sub-search will run first, then the Splunk will run the main search. Try MAP.