@iammax  Can you please try this? YOUR_FIRST_SEARCH | mvexpand all_animals | eval all_pets = all_animals | join type=left all_pets [ YOUR_SECOND_SEARCH | makemv all_pets delim="|" | mvexpand all_pets ] | bin _time span=5m | stats values(id_pets) as id_pets, values(all_animals) as animals by _time id_animals | eval id_pets=if(isnull(id_pets),"NO MATCH",id_pets) | table id_animals animals id_pets   I hope this will help you. Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.   ... View more

 what if both query1 and query2 has values in 2 or 3 fields? How can I check if any field on query1 matches in any field of query2? That is exactly why every helper on this forum emphasizes that you need to illustrate your data, including characteristics like this.  Otherwise others just waste time trying to read your mind. Because the task is really just trying to match user with ID via any field value, I'll assume that whether a match occurs in field1 or field2 or field3 is of no importance and simplify the output; you can still work out a way to preserve the original field ID if that's important. (Just take away all the stats and work them back in.)   | rename SQ*-field* as SQ*_field* | foreach SQ*_field* [eval SQ_field = mvappend(SQ_field, <<FIELD>>)] | mvexpand SQ_field | stats values(SQ1-user) as user values(SQ2-ID) as ID by SQ_field | stats values(ID) as ID values(SQ_field) as SQ_field by user | fillnull ID value="NOT FOUND"    With your sample data, the output is user ID SQ_field doe 002 banana jane NOT FOUND berry orange john 001 apple berry mango Hope this helps. ... View more

If you're looking for something in a lookup table then the correct command to use is lookup.  You look for the given value in the table and get some other field from the lookup table in response.  If the response is not NULL then the value exists in the lookup. | lookup mylookup.csv user_field OUTPUT foo | where isnotnull(foo)   ... View more