I have a scenario where typical HTTP requests are logged in Splunk. Every request has an unique identifier which is saved in a "request_id" field. Between request and response the server generates a set of logs/events and each one has  this "request_id" added. So far so good. Now it is possible to find the appropriate server logs for a client HTTP issue via the "request_id". Now I often also have the requirement to find all errors for a particular device. In this scenario the device identifier is part of the first log/event of the request, but the following logs/events do not have this information any more. So basically something like: 1. req.begin "Started... deviceId=12345", request_id="1" 2. .... "request_id="1" deviceId=??? 3. .... "request_id="1" deviceId=??? 4. .... "request_id="1" deviceId=??? 5. req.end ... "request_id="1" deviceId=??? The search would look like: - Search for all "request.begin" events with device identifier "xyz" - Get all "request_id" of those events - and finally get all events containing one of the above "request_id" Not sure how to build the query for this. 🤔 Would be very grateful for some tips! Best regards Tore ... View more