Hi, Have logs for both request to a server and its response. However, in some cases the response won't be received and want to get those missed records only to a new table. User id is the common functionality appearing in both logs. index=mtest ("X-Responding-Instance:ms*" OR "HTTP request to ms is registered successfully") | rex field=_raw ".*X-userid: (?<Success_UserId>.*)" | table Success_UserId usrId X-userid is coming as a header in response and I have to extract value from there. 'usrId' is already coming along with the 'registered successfully' message as a field and I can extract it without rex. The moment I add '| tableSuccess_UserId usrId' to above query, gets two table with values, but the records are coming in alternate lines and that maybe the reason I'm not able to compare between them. Is there any option to compare between the data in two tables and find out the records of usrId, that are missing in Success_UserId table? ... View more