Unable to Put Together Join Search

[IRHM73]

Hi, I wonder whether someone may be able to help me please.

After reading the Splunk documentation I'm trying to put together a Join query with the following:

index="main" auditSource=*auth* auditType=LoginEntitlements detail.EmpRef=* 
  | rename detail.EmpRef AS REF
  |Join REF [Chris EI-GG]
  | stats count by REF

Where [Chris EI-GG] is the name of the saved search which I want to join to the above.

I've clearly done something wrong because I receive the error 'Unknown search command 'chris'.

Could someone perhaps explain to me please where I've gone wrong.

Many thanks and kind regards

Chris

[chanmi2 · Accepted solution]

Hi, you may want to take a look at this answer
http://answers.splunk.com/answers/55715/joining-results-from-saved-searches.html
and try

join REF [| savedsearch "Chris EI-GG" ]

Hope this help

[IRHM73]

Hi @chanmi2, thank you once more for helping me out with this. It is greatly appreciated and works fine.

Kind regards

Chris