Hi there, Hoping someone could help me out. I'm currently using the AWS Add-On For Splunk and I wanted to expand the EC2 CPU Usage template that was provided (my 2nd search example below) . I've adjusted it a bit to provide me a list of instance ids in a timechart format. This works great, however I wanted to try to cross-reference it with another search that could give me the "name" tag of the EC2 using another index rather than the id. 1st search - This search gives me a list of "instanceids" and "names" i-123456789, server1 i-234567890, server 2 index="description" | spath output="dInstanceId" id | search id="i-*" | spath output="dInstanceName" "tags.Name" | search "tags.Name"="*" |dedup dInstanceName |table dInstanceId, dInstanceName 2nd search - This search gives me the CPU Utilization metric. i-123456789 2018-12-16 11:00:00 0.50 index="cloudwatch" metric_name=CPUUtilization | rex field=metric_dimensions "^(?<cwInstanceId>(\bInstanceId=.*\b))" | eval cwInstanceId = trim(replace(cwInstanceId, "InstanceId=\[", "")) | timechart eval(round(avg(Average),2)) by cwInstanceId where max in top10 My end goal is to have it reference the 1st search and provide a: server1 2018-12-16 11:00:00 0.50 I attempted trying to cross-compare with an appended search without any luck. Would a join be used in this scenario? Or should I attempt to send the first search to a lookup table then try to input that data into the 2nd search? Any help would be appreciated! Thanks, T ... View more