You should be able to do it with a join-command. Can you show us what you've tried? One way to go about it would be to rename either of the fields so that both fields have the same name: index="itsi_grouped_alerts" source="ABC" sourcetype=itsi_notable:group | where itsi_group_id="8a84c088-ba86-4d0a" | stats values(*) as * by itsi_group_id | join itsi_group_id [ search index="itsi_notable_audit" source="Notable Event Audit" sourcetype=itsi_notable:audit event_id="8a84c088-ba86-4d0a" | stats values(*) as * by event_id | rename event_id as itsi_group_id ]   Alternatively, you can keep the original names and use the where clause in the join-command: index="itsi_grouped_alerts" source="ABC" sourcetype=itsi_notable:group | where itsi_group_id="8a84c088-ba86-4d0a" | stats values(*) as * by itsi_group_id | join left=L right=R where L.itsi_group_id = R.event_id [ search index="itsi_notable_audit" source="Notable Event Audit" sourcetype=itsi_notable:audit event_id="8a84c088-ba86-4d0a" | stats values(*) as * by event_id ]   See the documentation for more information on the join-command. ... View more