Hello, Help me please. I'd like to define multiple search or subsearch to merge all relevant information about alerts. Interesting fields in search are  the hosts - as managed_host field and an uniqe alert number. I do not need alert about all the hosts, so i sort the relevant ones:  index=main ( managed_host="host_A" OR managed_host="host_B" OR managed_host="host_C" ) | dedup alert_num |  eval alert=alert_num Thats simple, will show the relevant alert numbers. After that i need to simple search the selected alerts to get ALL the logs ( some of them doesn't contain managed_host filed, so will not appear at first search.) Index=main alert_num=$alert$ How could be merged this two search in one to generate an alert that will contain all relevant information? Thanks, Gabor     ... View more