A splunk novice question We have logs and the example is something like this 2016-05-05T09:05:50.610050-07:00 Correlation-Id="XYZ" category="" request body :{} 2016-05-05T09:05:51.610050-07:00 Correlation-Id="XYZ" category="" response body :{} I want to query in such a way that I am looking for a specific text in response body (that would be something like index=abc host=myserver "ERROR") as well the request body. So that I get a consolidated list of all the correlation-Ids which I can use. Please NOTE: The request and response are in two different log lines Is such query possible ? ... View more