I want to join two source types ST1(has fields id,title) and ST2(no fields only _raw="xid https://www.example.com?q1=test1&q2=test2") . I have tried via join it is working but due to sub search row constraint, I  am getting wrong result. I have tried without join(sourcetype="ST1" OR sourcetype="ST2" approach), I am getting incorrect result. sourcetype="ST1" (id,title are fields here) id=1 title=one id=2 title=two  id=3 title=three sourcetype="ST2" _raw 1 "GET https://www.example.com?q1=one" 2 "GET https://www.example.com?q1=test&q2=test2"  3 "GET https://www.example.com?q3=thr" I want to join these source types and get the below output(grab the url params alone in source type ST2). Can you please help me on this? id title params 1 one q1=one 2 two q1=test&q2=test2 3 three q3=thr ... View more