https://community.splunk.com/t5/Splunk-Search/Map-search/m-p/566167#M197305 <P>Try something like:</P><LI-CODE lang="markup">index=pivotal sourcetype=ApplicationTest ("SearchString" OR "SOAPResponse") CorrelationId="*" | stats values(*) as * by CorrelationId | search "SearchString"</LI-CODE> Tue, 07 Sep 2021 14:54:58 GMT ITWhisperer 2021-09-07T14:54:58Z https://community.splunk.com/t5/Splunk-Search/Map-search/m-p/566161#M197300 <P>Hi,</P><P>I am using below query to search all correlation ID based on a search string and get the SOAPResponse using map search, But this is returning a partial search results. Is my query looks good ?</P><P>index=pivotal sourcetype=ApplicationTest "SearchString" CorrelationId="*" | table CorrelationId | map search="search index=pivotal sourcetype=ApplicationTest $CorrelationId$ SOAPResponse"</P><P>Thanks, Bhuvan.</P><P>&nbsp;</P> Tue, 07 Sep 2021 14:42:48 GMT https://community.splunk.com/t5/Splunk-Search/Map-search/m-p/566161#M197300 BhuvanM 2021-09-07T14:42:48Z https://community.splunk.com/t5/Splunk-Search/Map-search/m-p/566167#M197305 <P>Try something like:</P><LI-CODE lang="markup">index=pivotal sourcetype=ApplicationTest ("SearchString" OR "SOAPResponse") CorrelationId="*" | stats values(*) as * by CorrelationId | search "SearchString"</LI-CODE> Tue, 07 Sep 2021 14:54:58 GMT https://community.splunk.com/t5/Splunk-Search/Map-search/m-p/566167#M197305 ITWhisperer 2021-09-07T14:54:58Z