I'm trying to build a search that returns the changes that were made to the GPO. For this, I have my main search that looks for EventCode 4662, 5137, 5136, 5141 that are related to changes in the GPO, but do not bring what the change was specifically. I have another index (AD AUDIT) that logs all changes. I'm trying to use join, but I can't get the changes to return. Changes have more than one field for each GPO_GUID. My search looks like this: index=win (EventCode=4662 ObjectType=groupPolicyContainer) OR (EventCode=5137 ObjectClass=groupPolicyContainer) OR (EventCode=5136 ObjectClass=groupPolicyContainer) OR (EventCode=5141 ObjectClass=groupPolicyContainer Tree_Delete=yes) | rex field=ObjectName "(?i)CN=(?<gpo_guid>{.*?})" | rex field=ObjectDN "(?i)CN=(?<gpo_guid>{.*?})" | join type=left gpo_guid [ search index=summary objectClass=groupPolicyContainer earliest=-24h@h latest=now() | stats count by cn, displayName | fields + cn, displayName | rename cn as gpo_guid ] | eval action=case(EventCode=5137, "CREATED", EventCode=5136, "MODIFIED", EventCode=5141, "DELETED") | table action, src_user, displayName, gpo_guid, ObjectGUID | rename ObjectGUID as ADDITIONAL_INFO | join max=0 type=left ADDITIONAL_INFO [ search index=audit | stats values(ATTRIBUTES_NEW_VALUE) as ATTRIBUTES_NEW_VALUE, values(ATTRIBUTES_OLD_VALUE) as ATTRIBUTES_OLD_VALUE by ADDITIONAL_INFO | fields ADDITIONAL_INFO, ATTRIBUTES_NEW_VALUE, ATTRIBUTES_OLD_VALUE]   Is my search correct? For the join to run successfully I need the search field 1 to be the same as the search field 2, correct? If the changes in GPOs are multiple, how can I get these results?   ... View more