Why does subsearch always have zero results?

[Lavani]

Hello Everyone.

I have a search with a subsearch that's correctly running on a test environment (Splunk 8.2.9). Now I copied it on a production environment (Splunk 82.9), but it doesn't run: the subsearch has always zero as result.

| rest /services/authorization/roles/
| search title="logmon_app*" | table title
| rename title as role
| join type=left role max=0
[| rest /services/authentication/users
| table roles title
| rename title as userName,roles as role
| mvexpand role | search role="logmon_app*" ]
| stats values(userName) as username by role | eval rolepresent="yes"
| outputlookup logmon_roles_users.csv override_if_empty=false,

Thank you 

[inventsekar]

Hi @Lavani 

Please run only the subsearch part on the production and see if it gives any output:

| rest /services/authentication/users
| table roles title
| rename title as userName,roles as role
| mvexpand role | search role="logmon_app*"