Hi, I know this is a hot topic and there is answers everywhere, but i couldn't figure out by my self what to do.   Suddenly the join stops work and my search is not performing as spect anymore, nobody from infa gave me a reasonable explanation for that, so i have to figure out a different way .   Original Search   index=aws-prd-01 application.name=domestic-batch context=BATCH action=SEND_EMAIL (status=STARTED OR status="NOT RUN") | rename status as initialStatus | fields jobId initialStatus | join type=left jobId [search index=aws-prd-01 application.name=domestic-batch context=BATCH action=SEND_EMAIL (status=COMPLETED OR status=FAILED) | rename status as finalStatus | fields jobId finalStatus] | table jobId initialStatus finalStatus | sort -timestamp     Original result jobId initialStatus finalStatus 01 STARTED COMPLETED 02 STARTED FAILED   First search with no changes   index=aws-prd-01 application.name=domestic-batch context=BATCH action=SEND_EMAIL (status=STARTED OR status="NOT RUN") | table jobId, status     Result jobId status 01 STARTED 02 STARTED   Second search with no changes   index=aws-prd-01 application.name=domestic-batch context=BATCH action=SEND_EMAIL (status=COMPLETED OR status=FAILED) | table jobId, status     Result jobId status 01 COMPLETED 02 FAILED   thanks a lot ... View more