Splunk subsearch is not returning the data I expect it to return - splunk

Question

I have:
index="myIndex"
source="mySource1"
source="mySource2"
mySource1 example
2023-02-01 17:00:01 - Naam van gebruiker: hank - Rol van gebruiker: operator
2023-02-02 17:00:01 - Naam van gebruiker: skylar - Rol van gebruiker: operator
2023-02-03 17:00:01 - Naam van gebruiker: walt - Rol van gebruiker: operator
2023-02-02 17:00:01 - Naam van gebruiker: skylar - Rol van gebruiker: administrator
2023-02-03 17:00:01 - Naam van gebruiker: walt - Rol van gebruiker: administrator
mySource2 example
2023-02-06 13:49:57,654 User:hank The user is authenticated and logged in.
2023-02-07 13:49:57,654 User:skylar The user is authenticated and logged in.
2023-02-08 13:49:57,654 User:walt The user is authenticated and logged in.
2023-02-03 13:49:57,654 User:hank The user is authenticated and logged in.
2023-02-02 13:49:57,654 User:skylar The user is authenticated and logged in.
2023-02-01 13:49:57,654 User:walt The user is authenticated and logged in.
In Splunk I need a dashboard, with a statisticstable, looking like this:
USER, LATEST
hank, 2023-02-03 13:49:57,654 User:hank The user is authenticated and logged in.
skylar, 2023-02-02 13:49:57,654 User:skylar The user is authenticated and logged in.
walt, 2023-02-01 13:49:57,654 User:walt The user is authenticated and logged in
Where USER is column 1 and LATEST column 2. The purpose of the table is to show the user id's (found in mySource1) and show the latest login event (found in mySource2) so that you can tell when each user last logged in.
Initially I tried this:
index="myIndex"
source="mySource1"
| fields _time, _raw
| rex "Naam van gebruiker: (?<USER>.+) -"
| dedup USER
| table USER
| sort USER
| join type=left
[ search
index="myIndex"
source="mySource2"
"User:myUserID The user is authenticated and logged in."
| stats latest(_raw)
]
But I found out that I the second search, returns data to the first search. Also, I did not fetch the name from the second search. I later tried the following:
index="myIndex" source="mySource2"
"The user is authenticated and logged in."
| rex "User:(?<USER>\w+) The user is authenticated and logged in."
| search [search index="myIndex"
source="mySource1"
| rex "Naam van gebruiker: (?<USER>.+) -"
| dedup USER
| table USER
| sort USER
| format]
| stats latest(_raw) by USER
But this does not return any data. I tried running both searches seperately, and when I do, they return the data I need:
index="myIndex" source="mySource2"
"The user is authenticated and logged in."
| rex "User:(?<USER>\w+) The user is authenticated and logged in."
| table USER
| dedup USER
index="myIndex"
source="mySource1"
| rex "Naam van gebruiker: (?<USER>.+) -"
| dedup USER
| table USER
| sort USER
But once combined, no data is returned.
How do I manage to return the data and get the desired table of results?
EDIT: Forgot to mention, I also need to show users who have a role (source1) but have never logged in (not found in source2). Hence mySource1 is used.

Answer 1

You should be able to combine it all in one go:
index=ndx (source=source1 OR source=source2)
| rex field=_raw "Naam[^:]+:\s(?<user1>\S+)
| rex field=_raw "User:(?<user2>\S+)\s(?<msg>.+)
| eval user=coalesce(user1,user2)
| stats max(_time) as _time latest(msg) as msg by user
What this does: extract two field (user1 & user2) from your two sources
coalesce them into one field named "user"
Report the most recent msg for that user and the most recent _time you have an event for
(You should be able to abbreviate this slightly by using the same named field extraction (user) instead of two with a coalesce, I just wanted it to be clear)
edit to add users that have never logged in
index=ndx source=source1
| rex field=_raw "Naam[^:]+:\s(?<user>\S+)[^:]+:\s(?<role>\w+)"
| stats values(role) as roles by user
| append
[search index=ndx source=source2
| rex field=_raw "User:(?<user>\S+)\s(?<msg>.+)
| stats latest(msg) as msg max(_time) as msg_time by user ]
| stats values(*) as * by user
| where isnull(msg)
Here we're looking for a list of all users that have roles first, then appending the latest message for each user, then stats values() them together and throw away all entries that don't have a msg field via the where clause