Hello I would like to pass a value from a joined search (e.g. in this case the "Side") to the final table. I tried different append approaches with no success. Also I believe the performances of the below query could potentially be enhanced. It works, but maybe the use of transaction is not perfect. cs_stage=PROD cs_component_id=TOU TOFF_MARGIN_CALCULATOR | rex field=_raw "channel name: (?<reqid>.*)," | transaction reqid | join reqid [search cs_stage=PROD cs_component_id=TOU rest.ValidateTradingOrderRestAdaptor.validateTradingOrder | rex field=_raw "<transactionType>(?<Side>.*)<\/transactionType>"] | rex field=_raw "inflight_order_exposure: (?<InflightOrderExposure>\d*\D*\d*)" | rex field=_raw "open_orders_exposure: (?<OpenOrdersExposure>\d*\D*\d*)" | rex field=_raw "positions_exposure: (?<PositionExposure>\d*\D*\d*)" | rex field=_raw "total_potential_exposure: (?<TotalPotentialExposure>\d*\D*\d*)" | rex field=_raw "limit: (?<Limit>\d*\D*\d*\D*\d*)" | rex field=_raw "limit_type_value: (?<LimitTypeValue>\S*)" | rex field=_raw "available_limit: (?<AvailableLimit>\d*\D*\d*\D*\d*)\s*," | rex field=_raw "cif_=(?<CIF>.*[0-9]),memoizedIsInitialized" | rex field=_raw "csfid_=(?<csfiid>.*),shortSale_" | table reqid _time CIF Side csfiid InflightOrderExposure OpenOrdersExposure PositionExposure TotalPotentialExposure Limit LimitTypeValue AvailableLimit duration
... View more