I am writing a subsearch to get a user details as input for someother search but it is not working when i include the subsearch . need help asap

[arunsundarm]

index=* [search index=_internal [| rest /services/authentication/current-context splunk_server=local | fields username | rename username as user ] |top user limit=1 | fields user ]

[arunsundarm]

"index=* [search index=_internal [| rest /services/authentication/current-context splunk_server=local | fields username | rename username as user ] |top user limit=1 | fields user ] "

[maciep]

do you have non-internal indexes with a field named called user that would match the username of the user running this? the subsearch seems to work for me when I just look at internal logs.

[Sukisen1981]

Bit difficult to understand your requirement, but if you try this , is the first part of your need achieved?
index=_internal | join user type=inner
[| rest /services/authentication/current-context splunk_server=local | fields username | rename username as user |top user limit=1
| fields user]