@richgallowayThank you and I could not try this out due to some issues and will try it today and keep you updated. Regards, Neelesh ... View more

@richgallowayYes, I get confused so basically I gave two searches so if I combine it so I will be able to get the data so can you help that how can I combine the two query. aws-description-resource( (aws_account_id="*") , (region="*") , "ec2_instances") | search (private_ip_address="172.20.187.54") index=c3d_security host=ip-172-23* rule=corp_deny_all_to_untrust NOT dest_port=4431 | table src_ip dest_ip transport dest_port application   With the help of my first query, I can get the private IP address which is machine the host name so if I merge both the query so can I get the expected result?   Can this one below help me out with it. sourcetype="Sourcetype_A" s1_field4="Completed" | search s1_field1=$from_token$ | join s1_field2 [ search sourcetype="Sourcetype_B" | rename s2_field1 as s1_field2 ] | table s1_field2, s1_field1,s2_field2,s2_field3   https://community.splunk.com/t5/Splunk-Search/How-to-combine-two-searches-with-common-value-into-one-table/m-p/497485   Thanks, Neelesh Tiwari ... View more

@richgallowayThanks for the response, yes I wont get the instance name but we have the instance name but how can I extract the two datasets to table the Instance name.   Regards, Neelesh Tiwari ... View more

@ITWhisperer Thanks of the response , please find the raw data below.   <14>Dec 9 12:08:05 uw2-fw-02 1,2021/12/09 12:08:05,007255000201562,TRAFFIC,drop,2560,2021/12/09 12:08:05,172.30.197.3,172.217.14.227,0.0.0.0,0.0.0.0,corp_deny_all_to_untrust,,,not-applicable,vsys1,c3d_security_gwlbe,untrust,ethernet1/1.1,,c3d_logging_profile,2021/12/09 12:08:05,0,1,63629,443,0,0,0x0,udp,deny,0,0,0,1,2021/12/09 12:08:04,0,any,0,41289869,0x0,172.16.0.0-172.31.255.255,United States,0,1,0,policy-deny,0,0,0,0,,uw2-fw-02,from-policy,,,0,,0,,N/A,0,0,0,0,486b8130-2024-494d-998f-d38d1d99aeb2,0,0,,,,,,,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,2021-12-09T12:08:05.153-08:00,, ... View more