Hi @supriyagaw08, If WORK_NM is only exist on sub-search that is why your "field2" token filters everything on the first search. It will make Splunk search/join more events but below may work; $Env$ sourcetype = s | table XMIT_NM,USER_NM,WORK_ID,FILE_NM,FILE_ID | join [ search $Env$ sourcetype=b | table WORK_ID WORK_NM ] | search $field2$$input$ | table XMIT_NM,USER_NM,WORK_NM,FILE_NM,FILE_ID   If this reply helps you an upvote is appreciated.  ... View more

Hi @nickhills thanks for your help the issue was with search 2 it was not giving complete search I was looking for , fixed that and issue was resolved. ... View more

Thanks for your help  @ITWhisperer  i got why the count was always coming as 1. ... View more

I have file transfers events , I have got the first part of code but filtering it and displaying it based upon the count of file transfers in one day, one week and one month is where i am facing issue.   |bucket span=1mon _time | eval day=strftime(_time,"%Y-%m-%d") | eval week=strftime(_time, "%V") | eval w_month=strftime(_time, "%d/%m") |stats count(BASE_filename) as oneday by day | stats count(BASE_filename) as oneweek by week|stats count(BASE_filename) as onemonth by w_month ... View more