Want to filter events based on the existence of a field with the same value in a different log

[Josh1890]

Hello, I'm doing a detection for an event on the same index with 2 logs, I want to filter events of Event A based on if the username field exists with the same value in Event B.

I tried doing a sub-search but I get errors

going by the below query, I want to filter Event A by if there are any events from Event B with the same original_user

(index=<my index>) EventType="A" EventType=A
| rename username as original_user
| eval Id= mvindex((newValue),0) 
| eval Name= mvindex((newValue),1) 
    [ search index=<same index> <filtering by a string> 
    | eval src_email= mvindex((newValue),3) 
    | rex field=src_email "(?<original_user>[\w\d\.\-]+\@[\w\d\.]+)" 
    | fields original_user] 
| stats values(*) as *

The above query says my eval is malformed

Is there any way to solve it?
Append/Join?

I also tested the query inside the sub-search by itself and it works with no issues

[PickleRick]

Apart from what @richgalloway already pointed out the question is what are you trying to do. If you're trying to spawn a subsearch for each event from the base search... that doesn't work this way. You could use map to spawn a separate search for each result row but that's highly ineffective method. You're probably better of with appending two separate result sets and doing some magic on that compound data to get your results.

[richgalloway]

It would help to know the error you received, but I suspect it's a syntax error of some sort.  That's because subsearches have to be placed where their results would make semantic sense.

IOW, if the subsearch produces a result like (original_user=foo OR original_user=bar) then this makes no sense.

| eval Name= mvindex((newValue),1) 
    (original_user=foo OR original_user=bar) 
| stats values(*) as *

 Try this, instead

(index=<my index>) EventType="A" EventType=A
| rename username as original_user
| eval Id= mvindex((newValue),0) 
| eval Name= mvindex((newValue),1) 
| search [ search index=<my index> <filtering by a string> 
    | eval src_email= mvindex((newValue),3) 
    | rex field=src_email "(?<original_user>[\w\d\.\-]+\@[\w\d\.]+)" 
    | fields original_user
    | format ] 
| stats values(*) as *

Or this similar query for better performance

(index=<my index>) EventType="A" EventType=A [ search index=<my index> <filtering by a string> 
    | eval src_email= mvindex((newValue),3) 
    | rex field=src_email "(?<original_user>[\w\d\.\-]+\@[\w\d\.]+)" 
    | fields original_user
    | rename original_user as username
    | format ]
| rename username as original_user
| eval Id= mvindex((newValue),0) 
| eval Name= mvindex((newValue),1) 
| stats values(*) as *

[Josh1890]

Thanks, I'll try your suggestion

And yes I agree, I think it's a syntax error, that's the error:
"Error in 'EvalCommand': The expression is malformed."