I want to get all events related to dnis=27159866 I can perform this by getting all the events with a sessionid or parentsessionid linked to the dnis=27159866 I have the following searches : to get all events with a sessionid linked to the dnis=27159866 The subsearch will get all sessionid linked to dnis=27159866 and then the search looks for all events with those sessionid's. sourcetype=vxml [search dnis=27159866 | fields sessionid] to get all events with a parentsessionid linked to the dnis=27159866 The subsearch will get all sessionid linked to dnis=27159866, put it in the parentsessionid field and then the search looks for all events with those parentsessionid's. sourcetype=vxml [search dnis=27159866 | eval parentsessionid=sessionid | fields parentsessionid] How can I combine those 2 searches in one search ? So events where sessionid OR parentsessionid is equal to a value returned from the subsearch. ... View more