Hi All, I`m looking to combine the two  searches below.  I have been messing around with it, but I don`t do this alot! - but I thought rather than put in my ramblings I would ask the basic need of the question. I basically want the 'state', 'startTime' and 'completeTime' from the second search to be added to the first search # search 1 index=vmware-taskevent sourcetype=vmware_inframon:events fullFormattedMessage="Task:*" | stats by info.entityName fullFormattedMessage info.entity.type info.queueTime userName vm.name computeResource.name createdTime info.task.moid | sort createdTime | table info.entityName fullFormattedMessage info.entity.type info.queueTime userName vm.name computeResource.name createdTime info.task.moid # search 2 index=vmware-taskevent sourcetype="vmware_inframon:tasks" | stats by entityName name queueTime startTime completeTime entity.type state reason.userName task.moid | table entityName name queueTime startTime completeTime entity.type state reason.userName task.moid There are common results from fields but not common field names.  Ie sourcetype=vmware_inframon:events has 'info.task.moid' and sourcetype="vmware_inframon:tasks" has 'task.moid' and the results from this field matches. This is the same for info.entityName and entityName ... View more