Hi @Yadukrishnan, You can add the below line into your Trendmmicro DDI logs sourcetype. I also added appGroup and app to regex which you may have problems with because of space. EXTRACT-values_with_spaces = appGroup=(?<appGroup>.+)\sapp=(?<app>.+)vLANId.*ruleName=(?<ruleName>.+)\sdeviceRiskConfidenceLevel ... View more

Hi @Yadukrishnan, yes you can search something in many indexes, the only attention is that you have to know which are the key fields: e.g if you have a field called IP in both indexes and a lookup containing the threat signatures in a column called IP, you could run something like this: (index=ips [ | inputlookup threat_signatres.csv | fields IP ]) OR index=waf | stats dc(indexes) AS dc_indexes values(indexes) AS indexs BY IP | where dc_indexes=2 in few words, you have to create in the main search both the search conditions united by the OR condition, then grouping results by the common field you have to check if the field in in both the indexes. you could also use the second search as subsearch but this solution has the limit of 50,000 results for the subsearch: index=ips [ | inputlookup threat_signatres.csv | fields IP ] [ search index=waf | fields IP ] | ...  for this reason I always prefer the first solution. Ciao. Giuseppe ... View more