I have an index that contains all the hits for our WAF and an index that contains the subsequent API call details for any of those hits that are an application calling one our APIs behind the WAF. There is a shared identifier that the WAF passes to the API call so we can link them together and see what IP, user agent string, etc. made that API call. I am trying to pull data from both indexes together into a nice table so that our devs and our security folks can see what API calls are being made, who/what is calling them, and the payloads.  API search: index=api source=api_call | rename id as sessionID | fields apiName, payload, sessionID WAF search: index=waf | fields src_ip, requestHost, requestPath, requestUserAgent, sessionID My attempt to join them on the sessionID which is not working. It returns no results. index=api source=api_call | rename message.id as sessionID | fields apiName, message.payload, sessionID | join sessionID [search index=waf | fields src_ip, requestHost, requestPath, requestUserAgent, sessionID] | table apiName, message.payload, sessionID, src_ip, requestHost, requestPath, requestUserAgent I know joins are not very performative, so I'm open to alternatives that don't use it, but I'm not sure what those would be. ... View more