You probably want to use a sub search that pulls the user id and matches (or NOT) across the other file. To do this: Create a field extraction for the userid in Log A & B. The field name should be exactly the same in both extractions. Search for all users that logged into System A and output only the userids. Similar to: source=Log_A user_logged_in | fields userid Use the latter search as the subsearch to find log ins for Log B. You must make sure the a field extraction exists for userid in Log B, otherwise the values passed from the subsearch won't match anything. Similar to: source=Log_B [search source=Log_A user_logged_in | fields userid] So, the above search should find all users that logged in to System A & B. To find users that have not logged into both, you should be able to NOT the sub search. source=Log_B NOT [search source=Log_A user_logged_in | fields userid] ... View more