index=a0_payservutil_generic_app_audit_prd sourcetype="npp:pom:stdout" eventCode="fundsReservationManualInterventionNeeded"   index=prod_payments OR index=a0_payservutil_generic_app_audit_prd sourcetype="npp:cbis:techevent" $selected_ID$ | rex mode=sed field=_raw "s/\x1f/|/g" | eval fields=split(_raw,"instructionReceiptIdentification=") | eval RN=mvindex(fields,1) | eval Recp=split(RN, "'") | eval ReceiptNumber=mvindex(Recp, 2) | eval EntityID=mvindex(Recp, 6) |dedup ReceiptNumber |table _time, ReceiptNumber, EntityID   The above two queries i am having it. First query identify the entity id which is having 'manualinterventionneeded' and second query get the receipt number by using that entity id. Entity ID in first query and instructionReceiptIdentification in second query having the same values. By matching these two values i want to get one query to create an alert.   Could you please help me on this ? ... View more