Why am I getting error "unknown search command index" with my subsearch?

[datablick]

Hello.

I have a search that looks for event id's that are the result of a regex:

index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.datablick.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid

This runs successfully. I would then like to use these event id's in a subsearch to pull out all events with those id's, not just the Quarantined ones. I tried a subsearch first:

index=app_sec_prod sourcetype="mcafee:emailgateway:file"  host="portal4.datablick.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid  [ index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.datablick.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]

and then tried a join:

index=app_sec_prod sourcetype="mcafee:emailgateway:file"  host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid search [ index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]

But I keep getting the error "unknown search command index" What am I doing wrong?

[jayannah · Accepted solution]

Your join syntax is incorrect

it should be

... | join eventid [search index=ap...... ]

So finally your query looks like:

index=app_sec_prod sourcetype="mcafee:emailgateway:file"  host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid [search  index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ]

[datablick]

Thank you!