Hi @MrGlass , Splunk isn't a database, so the join command must be used only when there isn't any other solution and when you have few data, instead use stats, somerhing lie this: (index=network "arp-inspection" OR "packets received") OR (index=cisco_ise sourcetype=cisco:ise:syslog User_Name="host/*")
| eval NetworkDeviceName=coalece(NetworkDeviceName, Network_Device)
| rename
mnemonic AS Port_Status
| rename src_interface AS "src_int"
| stats
earliest(device_time) AS device_time
values(User_Name) AS User_Name
values(src_ip) AS src_ip
values(src_mac) AS src_mac
values(message_text) AS message_text
values(Location) AS Location
values(Port_Status) AS Port_Status
BY "NetworkDeviceName" , "src_int"
| table device_time, NetworkDeviceName, User_Name, src_int, src_ip, src_mac, message_text, Location, Port_Status Ciao. Giuseppe
... View more