I have two different indexes, with the common field being username. One index that contains phishing history data. index="phish" One index that contains a list of usernames. index="poorpass" I'd like to join both indexes, and match them by username. So I'll have a list of users that are in both indexes. index="phish" status="Clicked Link" | eval username=email | rex field=username mode=sed "s/@\S+//g" | join host [search index="poorpass" group="username"] | table username My search goes through with no errors, but no events are returned. ... View more