Hi rich7177, I played around with the query and modified a few things, it is working for me. thank you very much! my search base.. | rex "MID\s+(?\d+)" | rex "MID\s+(?\d+)" | rex "MID\s+(?\d+)\s+was\s+generated\s+based\s+on\s+MID\s+(?\d+)" | transaction maxspan=15s org2_MID | search "by PXE encryption" | transaction maxspan=15s new2_MID ... View more