Subsearch problem- Why am I only receiving 1 value?

[bosseres1]

Hello everyone, asking your help with my subsearch query.

I need to find events in index="1", take from it Logon_ID, and run search query in another one index (index="2").

My current search

index="2" EventCode=4662 AND (Condition="1" OR Condition="2")
[ search index="1" EventCode=4624 Logon_Type=3
| eval Logon_ID=lower(Logon_ID)
| eval Logon_ID=mvindex(Logon_ID,-1)
| fields Logon_ID]

It doesn't work, as I understand main search runs only by 1 Logon_ID, though in index1 there are many Logon_ID values. What could be the reason?
Thank you.

[bosseres1]

I think I understood and the thing is that subsearch generates more than 10000 results, main search can't perform them all.

[ITWhisperer]

OK There are possibly two approaches. One is to fragment the subsearch into smaller chunks. The other way, which is probably the better approach, is to combine the index searches and identify when a logon id appears in both indexes. Try something like this

(index="2" EventCode=4662 (Condition="1" OR Condition="2")) OR (index="1" EventCode=4624 Logon_Type=3)
| eventstats dc(index) as indexes by Logon_ID
| where index="2" AND indexes=2

[ITWhisperer]

The subsearch is a filter - each row of the subsearch will contain Logon_ID="some_value_from_index1"

If the same value appears in the subsearch more than once, it will appear in the filter multiple times

<search 2> ((Logon_ID="user1") OR (Logon_ID="user2") OR (Logon_ID="user1"))

Is this what you are expecting?

[bosseres1]

yes, I need to get main search with such condition 
index="2" EventCode=4662 AND (Condition="1" OR Condition="2") AND (Logon_ID="1" OR Logon_ID="2")

where (Logon_ID="1" OR Logon_ID="2") are taken from subsearch

[ITWhisperer]

That is what your current search is doing (although you could add a dedup Logon_ID, and the AND is implied)

index="2" EventCode=4662 (Condition="1" OR Condition="2")
[ search index="1" EventCode=4624 Logon_Type=3
| eval Logon_ID=lower(Logon_ID)
| eval Logon_ID=mvindex(Logon_ID,-1)
| dedup Logon_ID
| fields Logon_ID]

[bosseres1]

I've tried it, but not works. Though in Index1 there is an event, containing same Logon_ID that I'm trying to find in Index2. 

[ITWhisperer]

The SPL looks correct, how about the data? Do you have any trailing spaces, for example?