Thank you for reply. This is not the output actually i am looking for. index="f5" sourcetype="f5:enterprise" AND (F5_URL=*abc.com* OR F5_vip=*abc.com* ) is a subset of "index="f5" sourcetype="f5:enterprise" F5_device=* ". Dashboard allows user to search for "F5_URL" and it will locate F5 device were url is hosted. Once device is located then we would like to run another query (within same dashboard) to check what different syslog events are reported by that device.