I've fixed some issues in your search. Try this and see if that works: index=qbo "daily.cron run at" | rex field=_raw "daily\.cron run at (?<StartTime>.*)" | append [ search index=qbo "daily.cron complete at" | rex field=_raw "daily\.cron complete at (?<EndTime>.*)" ] | table cluster, StartTime,EndTime| sort cluster Also, in order to improve the performance, I would try to write a more exhaustive regex avoiding the dot wildcard (.*) whenever possible. If you know how your start and end time format look like, use that in your regex. Thanks, J ... View more