Why am I unable to output from subsearch?

[harryhcg]

I am having 2 index - abc - FieldA, E, F bcz - Field B, C, D. Where I want to return D, C and F where value from field E to match with B. I am getting the required output but not able to get F values.

This is my query:

index=abc fieldA="<>"
| rex field=_raw .......FieldB .... FieldC.. Field D
| search [ index=bcz FieldF="<>" | rename FieldE as FieldB | fields FieldB]
| stats count as Total by _time, FieldD, FieldC, FieldF | where FieldD="<>"

[ITWhisperer]

According to your description, FieldF is in index abc not bcz.

[harryhcg]

@ITWhisperer  Apologies for confusion, let me try to rephrase. 

Index=abc. FieldA, B, C, D
index=bcz. FieldE,F,G

I want to return _time, B, C, D, G where value from field E to match with B. I am getting the required output but not able to get G values.

This is my query:

index=abc
fieldA="<>"
| rex field=_raw .......FieldB .... FieldC.. Field D
| search [ search index=bcz FieldF="<>" | rename FieldE as FieldB | fields FieldB]
| stats count as Total by _time, FieldD, FieldC, FieldG | where FieldD="<>"

[ITWhisperer · Accepted solution]

Your additional search command is just searching for matches in the initial search results, it does not introduce any new events to the result set. In order to do that, you either need to include both index in the initial search, or use append or use join.

[harryhcg]

@ITWhisperer Query performance is not very good but getting result.