Hello, Thank you both for all of the advice, really appreciate it. I've basically have been trying to piece this together from a lot of googling. My objective is the following: I have a Dashboard table that displays only the 'Create' events using the following Transaction Search. integrationName="Opsgenie Edge Connector - Splunk", alert.message = "STORE*", alert.message != "*Latency" alert.message != "*Loss" action != "AddNote" | transaction "alert.id", alert.message startswith=Create endswith=Close keepevicted=true | table _time, alert.updatedAt, alert.message, alert.alias, alert.id, action, "alertDetails.Alert Details URL", _raw, closed_txn, _time | where closed_txn=0 | rename alert.message AS "Branch" | rename "alertDetails.Alert Details URL" as "Source Link" | eval Created=strftime(_time,"%m-%d-%Y %H:%M:%S") | fields Created, Branch, "Source Link" | sort by Created DESC | fields - _raw, _time I have been asked to add a ServiceNow Incident # to this table. I was able to get the join working with the following Search (integrationName="Opsgenie Edge Connector - Splunk" alert.message = "STORE*") OR (sourcetype="snow:incident" dv_opened_by=OPSGenieIntegration) | eval joiner=if(integrationName="Opsgenie Edge Connector - Splunk", alertAlias, x_86994_opsgenie_alert_alias) | stats values(*) as * by joiner | where alertAlias==x_86994_opsgenie_alert_alias | rename dv_number as Incident | table alertAlias, Incident | fields alertAlias, Incident But I'm stuck on joining those two searches together to display in a table, the Created, Branch, and "Source Link" from the Transaction search, the Incident from the Join search, and only for the open transactions. The alertAlias and the opsgenie_alert_alias contain the same content, so I was doing the join on those. Again, thanks for all of the help, Tom
... View more