The Join command doesn't combine results from different indexes

[jamercadoh]

The search string shown below returns valid results when run in Splunk 4.3.4 but it doesn't in Splunk 5.0.

index=agent MTRn |fields MTRn S| join S [search svc="*"| fields svc, sessionId Site | rename sessionId AS S]|table MTRn S Site

The result shows empty values for the "MTRn" column and the "S" and "site" columns show data from the subsearch.

Cheers,

[jamercadoh]

The sub-search searches data in the "main" index whereas the outer does it in the "agent" index. I tried to include the index=main clause to no avail.

[Ron_Naken]

Your inner search is an entirely separate and unrelated search from the outer search, so it needs to also include the index to search: ie:

index=agent MTRn |fields MTRn S| join S [search index=agent svc="*"| fields svc, sessionId Site | rename sessionId AS S]|table MTRn S Site

[jamercadoh]

The sub-search searches data in the "main" index whereas the outer does it in the "agent" index. I tried to include the index=main clause to no avail.