I have two queries from the same set of index and app names using different search terms from which I am extracting a set of fields as below: Query1: index=A cf_app_name=B  "search string 1" | rex field=_raw "(?ms)Id: (?P<Id>[^,]+), service: (?P<service>[^,]+), serial: (?P<serial>[^,]+), Type: (?P<Type>[a-zA-Z-]+)" | table serial Id Type service _time Query 2: index=A cf_app_name=B "search string 2" | rex field=_raw "(?ms)serial\\W+(?P<serial>[^\\\\]+)\\W+\\w+\\W+(?P<Type>[^\\\\]+)\\W+\\w+\\W+\\w+\\W+(?P<Id>[a-zA-Z]+-\\d+-\\d+)\\W+\\w+\\W+(?P<gtw>[^\\\\]+)\\W+\\w+\\W+(?P<service>[^\\\\]+)" | table serial Type Id service _time My requirement is to list all the values in Query1 and then show a Y/N flag if there is a match in Query2 based on the field 'Id'. Tried join and append, but do not seem to be getting the right results, any suggestions will be appreciated. ... View more