Splunk Search

Why am I getting error "unknown search command index" with my subsearch?

datablick
Engager

Hello.

I have a search that looks for event id's that are the result of a regex:

index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.datablick.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid

This runs successfully. I would then like to use these event id's in a subsearch to pull out all events with those id's, not just the Quarantined ones. I tried a subsearch first:

index=app_sec_prod sourcetype="mcafee:emailgateway:file"  host="portal4.datablick.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid  [ index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.datablick.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]

and then tried a join:

index=app_sec_prod sourcetype="mcafee:emailgateway:file"  host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid search [ index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]

But I keep getting the error "unknown search command index" What am I doing wrong?

Tags (4)
1 Solution

jayannah
Builder

Your join syntax is incorrect

it should be

... | join eventid [search index=ap...... ]

So finally your query looks like:

index=app_sec_prod sourcetype="mcafee:emailgateway:file"  host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid [search  index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]

View solution in original post

jayannah
Builder

Your join syntax is incorrect

it should be

... | join eventid [search index=ap...... ]

So finally your query looks like:

index=app_sec_prod sourcetype="mcafee:emailgateway:file"  host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid [search  index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]

datablick
Engager

Thank you!

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...