Hi, I am trying to run below query and the scenario is here. This is not returning any results though match exists. Can you help me? 1) My subsearch yields multiple order numbers from file 1. 2) I need to pass this list to another file, file 2 which contains super set of the order numbers resulted in my subsearch. I want to fetch all the events which has orderNo from file 1 that are resulted in file 2. source="dir1/file1.log" [ search host="server1" source="dir2/file2.log" | rex field=_raw "\"orderNo\":\"(?\w*-\w*-\w*-\w*-\w*)" | stats count by orderNo | table orderNumbers | format ] I tried several variations of passing the sub search results (table, list, etc) to main search but not working. Can you please identify what is wrong here? ... View more