Koshyk's response should function and will provide more context, but you're not using the data from both searches,  you'd likely see improved performance using a sub-search. This probably doesn't matter unless you have a significant volume of events being evaluated. Search below is untested.   index=mail sourcetype=ppsmessagelog [index=mail sourcetype=proofpointtapsiem final_action=continue | stats values(GUID) as guid]   ... View more