Hi @kyoshiike, at first you have to identify the indexes where proxy and firewall logs are stored. then you have to identify the key )e.g. src or src_ip to correlate events. The transaction command is a command to use only in defined situations because it's a very slow command, it should be used only when you haven0t fields to use as correlation keys and you must use startswith and(or endswith strings to correlate events. In your case, you could use stats, see my approach and adapt to your requirement: index=firewall OR index=proxy | stats dc(dst_port) AS dst_port_count dc(dst) AS dst BY src in this way you know id a src is calling more destinations or more ports. Anyway, the approach is to put all in the main search and use the correlation key in a stats command, identifying what to search. The options to use in the stats command are many, for this reason I hinted to follo the Splunk Search Tutorial. ciao. Giuseppe