using rex inside map search

[a2021cdev]

index=error sourcetype=error_log "Retry counter reached"
| makemv delim="=",values
| dedup errId
| table errId 
       | map search="search index=error sourcetype=error_log $errId$ "Caused by" | head 1 | rex field=_raw  "MessageText=(?<FailureReason>.+) Please report to system admin"
       | eval FailureReason=\"$FailureReason$\"
       | eval errId=\"$errId$\""
| table errId, FailureReason

The above query does not show any results. If i run the searches separately, i do see the output. What is wrong with the query please?

[a2021cdev]

The query does not meet my requirement. It only lists errId and not the failure reason. 

[manjunathmeti]

Hi @a2021cdev,

Since you are searching same index and sourcetype, you don't need map.  Try this:

index=error sourcetype=error_log "Retry counter reached" OR "Caused by"
| rex  "MessageText=(?<FailureReason>.+) Please report to system admin"
| stats max(FailureReason) by errId

[a2021cdev]

The query does not meet my requirement. It does not correlate errId with failure reason.