Hello All, Could you please suggest to me whether this option is good or is there any optimized search query?  query --- index="XXX1" source="XXXX11" jsonbodyfield1=abc | search "jsonbodyfield2"=XXXX1 AND "jsonbodyfield3"=XXXX2 AND "jsonbodyfield3"="XXXX" AND jsonbodyfield4="XXX2" | stats count as Total The user will have drop down option to select "jsonbodyfield1" and "jsonbodyfield4" from the available values. Now this one field "jsonbodyfield4" is added new to the logs structure and since this is in AND condition so now the query shows the total count of records where this field is present (irrespective of its value).  However, whenever the default value (*) of "jsonbodyfield4" is chosen from the dropdown then i want to show all records where the field is present (in the new logs) and the field was not present (in the old logs). I was thinking to use multi-search query and having the where condition as (NOT jsonbodyfield4="*"). This might not work or may be not a good approach so could anyone please suggest? Thanks. ... View more