Need better option to get user id from first search to populate results using the subsearch.  thought join would work but its not.....suggestions? index=“something”  | rex field=userName "\'(?P<userName>.+)\'" | rex "\/ROOT\/[^\s']+\/(?P<Environment>[^\/]+)\/[^\s\/']+(\s|')" | search NOT (Environment=eu-central-1 OR Environment=BOLCOM) | rename commandTime as "Date/Time" | join userName     [ search index=okta sourcetype="OktaIM2:user" AND profile.department=*     | rename profile.employeeNumber as userName, profile.division as Department, profile.title as Title, profile.countryCode AS Country     | table userName, Department, Title, Country] | dedup Department, Title, Environment | table "Date/Time", Department, Title, Environment, Country ... View more