There are so many things wrong with this search... But regardless of that, it's hard to say what the proper search should look like without knowing your data. Provide us with a sample of your events (anonymized if needed) and a description of desired results. ... View more

Hi @Taibat02230232, if you're sure that one of the searches has less than 50,000 results, you can use append: index="aws-cloudtrail" eventName="AssumeRoleWithSAML" | spath "requestParameters.roleArn" | search "*super*admin*" | rex field=responseElements.subject "(?<Email>[a-zA-Z0-9]{1,8}@digitlogs.com$)" | search Email=* | table Email,"recipientAccountId" | dedup Email, "recipientAccountId" | append search index="okta" displayMessage="Authenticate user with AD agent" | rename target{}.alternateId as email | eval my_ponies=mvindex(email, -3, -2) | eval Email=mvindex(email, 0) | eval email=mvindex(email, 1) | table Email email ] | stats values(recipientAccountId) AS recipientAccountId values(email) AS email BY Email otherwise you have to use a more complex search. Ciao. Giuseppe ... View more