How to Join fields from 2 indexes

[r2r2]

Hello!
I am trying to make a dashboard with fields from 2 indexes using the command "join".
I wrote a search source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [index=anotherindex employeeID=*] | table _time, user, employeeID

But column employeeID is empty. What did I do wrong?

[jitsinha · Accepted solution]

Use this one

source="WinEventLog:Security" EventCode=4624 AccountName="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [search index=anotherindex employeeID=* ] | table _time, user, employeeID

[jitsinha]

glad it resolved your issue

[r2r2]

I found one more mistake in this search and now it works properly.
Your answer resolved my issue. Thank you!

[r2r2]

I added "search" but column "employeeID" is still empty.

[r2r2]

And I found a mistake - there is "AccountName*!="$""

source="WinEventLog:Security" EventCode=4624 AccountName!="*$" | eval user = mvindex(AccountName,1) |dedup user | join type=left user [ search index=anotherindex employeeID=* ] | table _time, user, employeeID

[jitsinha]

chersss!!!