I have looked at the join documentation, but I am getting a little lost in translation. What I am trying to accomplish, is to pull data from Index1, then join on IP address to another index to pull different information and display all of it. Example:   Index=firewall dest_port=21 | stats values(dest_ip) as dest_ip values(dest_port) as dest_port sum(bytes_in) as bytes_in sum(bytes_out) as bytes_out values(app) as app values(rule) as rule by user src _time Index=edr RPort=21 RemoteIP=$dest_ip-from-first-search   The output should be a table with the following: firewall._time, firewall.src, firewall.dest_ip, edr.username, edr.username, edr.processname The issue I am running into is the IP address field is named differently between the 2 indices.  Ideally I would join on firewall.dest_ip TO edr.RemoteIP Any help would be appreciated.  ... View more