You need to grab the fields from your ST2 data row with rex, e.g. try this example | makeresults | eval x=split("id=1 title=one,id=2 title=two,id=3 title=three", ",") | mvexpand x | eval _raw=x | extract | table id title _raw | append [ | makeresults | eval _raw="1 \"GET https://www.example.com?q1=one\" 2 \"GET https://www.example.com?q1=test&q2=test2\" 3 \"GET https://www.example.com?q3=thr\"" | multikv noheader=t | table _raw ] | rex field=_raw "^(?<id>\d+).*\?(?<params>.*)" | stats values(*) as * by id | table id title params  Note that the rex statement must only grab the id and params from the ST2 sourcetypes, so this relies on _raw from ST1 NOT matching the rex pattern, so that id from the ST1 is not overwritten by an extraction.   ... View more