Hi @gcusello  Thank you for your replies. But this seems to be not working. FYI you said coalsce c1,c3.. but the names are same (ID) I feel the OR condition you are mentioning is not right. I need a subsearch approach where for each value of  ID column in search 1 ,I should get a corresponding row in search 2 (every event in search 2 should  have the same value of ID ). Like I get 136 results in search 1, I should get the corresponding 136 events in search 2 with the common value ID. This is my query index=index2 name=name2 [search index=index1 name=name1 | fields ID]|table ID , Address   ID is the common column Search 2 has the columns  ID and Address, but search 1 has ID and Name... But I am getting only the columns from search 2. I want ID ,name and address in a table. I feel I should be able to append or join the two searches. Please help ... View more

Hi @gcusello  I tried this. But I am not getting the common events based on the field 1. the common field is present in both the searches all the time. I want the values where the common field value is same/equal in both searches. For example, Search 1 gives 3 columns C1 C2 C3 A.   a    1 B    b    2  C   c      3 I need to search where a C3 has the values 1,2 ,3 in another index and source. For each value in search 1 I want corresponding values in search 2 based on the common filed value. That's why I used sub search, which is giving the output. C1 C2 1.     x 2.     y 3.     z But  I want C1 C2 C3 1.     x.    A 2.     y.     B 3.     z.     C based on a common column, I want values from the search2 and also some corresponding columns in search 1.Hope I am clear. Think of 2 searches with the same column called IdNumber. I want the address of all the persons obtained in search 1(Id,name) from search 2. So I get  a table of Id,Address. But I want a table with Id name, address  ... View more