This is my sample logs in [bowlers]: "doYouBowl":"YES", "pin":"123", "name":"Billy" "doYouBowl":"NO", "pin":"456", "name":"Bob" "doYouBowl":"NO", "pin":"123", "name":"Mike" Expected results is that the "pin" number must match and the resulting join results will be: "doYouBowl":"YES", "pin":"123", "name":"Billy" "doYouBowl":"NO", "pin":"123", "name":"Mike" This is what I came up with by researching, but I get an error at 121-ish, where I try to join on pin and the second search: sourcetype="bowlers" \"doYouBowl\":\"NO\" | rex field=_raw "\"(?<pin>\d+)\"" | join pin [\"doYouBowl\":\"YES\" | rex field=_raw "\"(?<pin>\d+)\""] Looking at the answers here, got suggestions to use transactions or (translate?), but want to get this join to work first and foremost. Any assistance would be appreciated. Thank you. ... View more