Hi. I'm trying to use the subsearch, but I'm not what I am doing wrong. First the inner search is a list of account like this one. index=main sourcetype=vpacmanagement
|eval DateStamp3= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval MemberName2 = split(TeamMember, "\\")
| eval Member2 = mvindex(MemberName2,1) | eval Member2=upper(Member2)
| where DateStamp3 > relative_time(now(), "-4d") AND like(Status, "%/%/%") AND Member2 = "ADMMICHAEL_HAYES3"
|dedup WONumber | rename Member2 as Member | fields Member I get one account, all ok so far. But using the search in an outer search. index=main sourcetype=vpacmanagement|join Member[search index=main sourcetype=vpacmanagement
|eval DateStamp3= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval MemberName2 = split(TeamMember, "\\")
| eval Member2 = mvindex(MemberName2,1) | eval Member2=upper(Member2)
| where DateStamp3 > relative_time(now(), "-4d") AND like(Status, "%/%/%") AND Member2 = "ADMMICHAEL_HAYES3"
|dedup WONumber | rename Member2 as Member | fields Member]
| eval DateStamp2= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval month = strftime(DateStamp2, "%m")
| eval year = strftime(DateStamp2, "%Y")
| eval GroupName = split(DomainGroup, "\\"), MemberName = split(TeamMember, "\\")
| eval Name = mvindex(GroupName,1), Member = mvindex(MemberName,1) | eval RequestType = upper(RequestType), Name = upper(Name), Member=upper(Member)
| where not like(Status, "%/%/%") and DateStamp2 > relative_time(now(), "-2d")
|dedup RequestType,DomainGroup, TeamMember
| fields WONumber, DateStamp, ResourceSteward, RequestType, Name, Member, Status
| table WONumber, DateStamp, ResourceSteward, RequestType, Name,Member, Status | sort DateStamp2 If you see I made some calculation and I'm using Member field as value to make the join, but still is not getting any account from the outer, and in fact the element exists in the outer search, does anyone knows what am I missing? Thanks
... View more
