splunk query with sub search not returning the desired results

[vivek991985]

Query is:
index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input | rex ".]*Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | eval ID = "" + ID + "*" | return $ID ]

It returns the results for ID='2138536' (2 events as expected) but also returns additional events (5 more message events) for other IDs.

Please advise if there is anything wrong with the query.

[vinaypradhan]

what is the logic of the result that you are expecting? are you expecting to see only the common ones between File1.log and File2,log ? you can try using set intersect here, which should get you only the common entries.
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Set

[richgalloway]

Run the subsearch by itself to see what results it produces. Those results will be what the main search looks for so make sure they are correct before continuing.

[vivek991985]

Corrected:

index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input | rex ".]Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | eval ID = "" + ID + "" | return $ID ]