Hi All, Appreciate some suggestions for a problem I'm facing. I have a search which outputs a few results, and what I want to do is, take each results _time and modify the earliest and latest times to be within +/- 1 minute of the events, and pass on a value from a certain field to a second search.  I have looked at other answers and I can see suggestions for using subsearches, and also the map command. The problem is that though, the events from the original search are not kept this way. With the map command you can pass specific fields from the first search to be kept using further evals, however this gets tedious when you want to keep as many fields as possible. Example: First search (checks for 'file create' events in sysmon:      index=sysmon EventId=11 file_name=test_file* file_name="test_file.txt"     Let's say this produces 3 results, with 3 different times and 3 different users. time 1 test_file.txt user 1 time 2 test_file.txt user 2 time 3 test_file.txt  user 3 Bear in mind there would be other fields too in the actual events. Then what I would like to do is, take time 1 for example, extend the time range by 1 minute either side, and use a second search to pass in the file name and user name to see where this file was downloaded from. Second search:     index=web file_name=test_file.txt earliest=(time1 - 1min) latest=(time1 + 1min) user=user1       This should give me an additional event with the corresponding file download (with url etc.) , whilst keeping the 3 events from the 1st search. So when you look at all events, you would have both the file download event from the web index, and the file create event from sysmon, while keeping all the fields and values from both events.    Appreciate any ideas. Thanks!        

Hi All, I need help building a SPL that would return all available fields mapped to their sourcetypes/source  Looking across all Indexers crawling through all indexes index=* I currently use to strip off all the fields and their extracted fields but I have no idea where they are coming from, what is their sourcetype and source: index=* fieldsummary | search values!="[]" | rex field=values max_match=0 "\{\"value\":\"(?<extracted_values>[^\"]+)\"" | fields field extracted_values Thank you!