Hello, I'm trying to correlate events from 2 different source types, and 2 searches for example: sourcetypeA has fields IP_Address, MAC_Address, User sourcetypeB has the following fields: Time, IPAdd, hostname, DomainController. The IP Address field name is different from sourcetype A, ie: IPAdd, there are multiple events with the same pair, and I'm only searching events on a particular DomainController. I would like to display a table with the following result with one line for each IP Address: IP_Address, MAC_Address, User, hostname, DomainController I tried to use a subsearch like this: sourcetype=sourcetypeA [search sourcetype=sourcetypeB DomainController="DC1" | rename IPAdd as IP_Address | table IP_Address ] | table Time, IP_Address, MAC_Address, User, hostname, DomainController but it doesn't work. It only displays the values from the main search (SourcetypeA) (the fields from sourcetypeB are empty). I'm not sure if a subsearch is the best way to do this? Any clue? Thanks. ... View more