Dear experts I'm trying to move old xml dashboards to Dashboard Studio. Now I'm running into issues with a join which uses a base search.  I've created a basesearch Data_BaseSearch Datasource_id=ds_Zwp0QfAJ index="pm-azlm_internal_prod_events" sourcetype="azlmj" d_id IN (DIAG_162, DIAG_164, DIAG_165, DIAG_166, DIAG_218, DIAG_219, DIAG_220, DIAG_221, DIAG_222, DIAG_224, DIAG_225, DIAG_226, DIAG_227, DIAG_228, DIAG_229, DIAG_234) ocp IN ($t_ocp$) fr IN ($t_fr$) el IN ($t_el$) [| inputlookup pm-azlm-reg-ocp-team | search team IN ($t_team$) | fields ocp ]   Afterwards I'm creating the table data with | stats count(eval(d_id IN ("DIAG_162", "DIAG_164", "DIAG_165", "DIAG_166"))) AS "ZP_Def" count(eval(d_id IN ("DIAG_218", "DIAG_219"))) AS "UART" count(eval(d_id IN ("DIAG_220", "DIAG_221", "DIAG_222"))) AS "DEF_W" count(eval(d_id IN ("DIAG_224", "DIAG_225", "DIAG_226"))) AS "Drift_W" count(eval(d_id IN ("DIAG_227", "DIAG_228", "DIAG_229"))) AS "WPoZ" count(eval(d_id IN ("DIAG_234"))) AS "Versatz" by ocp fr el | table ocp fr el "ZP_Def" "UART" "DEF_W" "Drift_W" "WPoZ" "Versatz" Until here everything works.  Now the challenge: for every counter I need to know date/time of the last event.  My current draft for this is to do a join (per counter, below is only one prototype shown) in which I search the needed timestamp to be joined to the already existing data. The join should reuse the data generated by the basesearch, as there in is already a lot of (token based) filtering I don't won't to redo for every counter/ join again.  | stats count(eval(d_id IN ("DIAG_162", "DIAG_164", "DIAG_165", "DIAG_166"))) AS "ZP_Def" count(eval(d_id IN ("DIAG_218", "DIAG_219"))) AS "UART" count(eval(d_id IN ("DIAG_220", "DIAG_221", "DIAG_222"))) AS "DEF_W" count(eval(d_id IN ("DIAG_224", "DIAG_225", "DIAG_226"))) AS "Drift_W" count(eval(d_id IN ("DIAG_227", "DIAG_228", "DIAG_229"))) AS "WPoZ" count(eval(d_id IN ("DIAG_234"))) AS "Versatz" by ocp fr el | join ocp fr el [ search base=ds_Zwp0QfAJ | where d_id IN (DIAG_162, DIAG_164, DIAG_165, DIAG_166) | stats latest(_time) as last_ZP_Def by ocp fr el | eval last_ZP_Def=strftime(last_ZP_Def,"%Y-%m-%d %H:%M:%S") | fields ocp fr el last_ZP_Def] | table ocp fr el "ZP_Def" last_ZP_Def "UART" "DEF_W" "Drift_W" "WPoZ" "Versatz"   The question is: how to reference the basesearch in the join?  Nor basesearch name or the datasource_id of the basesearch.  Addon after the first feedback from different users First of all thank you for your help.  @yuanliu : I don't think what I'm doing can be done as chain search.  @livehybrid : just one field doesn't help   The current (brute force) solution looks like:  ```***** First get all the lines related to the error codes in question ``` index="pm-azlm_internal_prod_events" sourcetype="azlmj" d_id IN (DIAG_162, DIAG_164, DIAG_165, DIAG_166, DIAG_218, DIAG_219, DIAG_220, DIAG_221, DIAG_222, DIAG_224, DIAG_225, DIAG_226, DIAG_227, DIAG_228, DIAG_229, DIAG_234) ocp IN ($t_ocp$) fr IN ($t_fr$) el IN ($t_el$) [| inputlookup pm-azlm-reg-ocp-team | search team IN ($t_team$) | fields ocp ] ```***** Multiple error codes do belong to the same error category``` ```***** Count per category the number of errors received``` | stats count(eval(d_id IN ("DIAG_162", "DIAG_164", "DIAG_165", "DIAG_166"))) AS ZP_Def count(eval(d_id IN ("DIAG_218", "DIAG_219"))) AS UART count(eval(d_id IN ("DIAG_220", "DIAG_221", "DIAG_222"))) AS DEF_W count(eval(d_id IN ("DIAG_224", "DIAG_225", "DIAG_226"))) AS Drift_W count(eval(d_id IN ("DIAG_227", "DIAG_228", "DIAG_229"))) AS WPoZ count(eval(d_id IN ("DIAG_234"))) AS Versatz by ocp fr el ```***** Per error category we want to know when the last error was recorded``` | join ocp fr el type=outer [ search index="pm-azlm_internal_prod_events" sourcetype="azlmj" d_id IN (DIAG_162, DIAG_164, DIAG_165, DIAG_166) ocp IN ($t_ocp$) fr IN ($t_fr$) el IN ($t_el$) [| inputlookup pm-azlm-reg-ocp-team | search team IN ($t_team$) | fields ocp ] | stats latest(_time) as last_ZP_Def by ocp fr el | eval last_ZP_Def=strftime(last_ZP_Def,"%Y-%m-%d %H:%M:%S") | fields ocp fr el last_ZP_Def] | join ocp fr el type=outer [ search index="pm-azlm_internal_prod_events" sourcetype="azlmj" d_id IN (DIAG_218, DIAG_219) ocp IN ($t_ocp$) fr IN ($t_fr$) el IN ($t_el$) [| inputlookup pm-azlm-reg-ocp-team | search team IN ($t_team$) | fields ocp ] | stats latest(_time) as last_UART_Def by ocp fr el | eval last_UART_Def=strftime(last_UART_Def,"%Y-%m-%d %H:%M:%S") | fields ocp fr el last_UART_Def] | join ocp fr el type=outer [ search index="pm-azlm_internal_prod_events" sourcetype="azlmj" d_id IN (DIAG_220, DIAG_221, DIAG_222) ocp IN ($t_ocp$) fr IN ($t_fr$) el IN ($t_el$) [| inputlookup pm-azlm-reg-ocp-team | search team IN ($t_team$) | fields ocp ] | stats latest(_time) as last_DEF_W by ocp fr el | eval last_DEF_W=strftime(last_DEF_W,"%Y-%m-%d %H:%M:%S") | fields ocp fr el last_DEF_W] | join ocp fr el type=outer [ search index="pm-azlm_internal_prod_events" sourcetype="azlmj" d_id IN (DIAG_224, DIAG_225, DIAG_226) ocp IN ($t_ocp$) fr IN ($t_fr$) el IN ($t_el$) [| inputlookup pm-azlm-reg-ocp-team | search team IN ($t_team$) | fields ocp ] | stats latest(_time) as last_Drift_W by ocp fr el | eval last_Drift_W=strftime(last_Drift_W,"%Y-%m-%d %H:%M:%S") | fields ocp fr el last_Drift_W] | join ocp fr el type=outer [ search index="pm-azlm_internal_prod_events" sourcetype="azlmj" d_id IN (DIAG_227, DIAG_228, DIAG_229) ocp IN ($t_ocp$) fr IN ($t_fr$) el IN ($t_el$) [| inputlookup pm-azlm-reg-ocp-team | search team IN ($t_team$) | fields ocp ] | stats latest(_time) as last_WPoZ by ocp fr el | eval last_WPoZ=strftime(last_WPoZ,"%Y-%m-%d %H:%M:%S") | fields ocp fr el last_WPoZ] | join ocp fr el type=outer [ search index="pm-azlm_internal_prod_events" sourcetype="azlmj" d_id IN (DIAG_234) ocp IN ($t_ocp$) fr IN ($t_fr$) el IN ($t_el$) [| inputlookup pm-azlm-reg-ocp-team | search team IN ($t_team$) | fields ocp ] | stats latest(_time) as last_Versatz by ocp fr el | eval last_Versatz=strftime(last_Versatz,"%Y-%m-%d %H:%M:%S") | fields ocp fr el last_Versatz] ```***** Finally the table``` | table ocp fr el ZP_Def last_ZP_Def UART last_UART_Def DEF_W last_DEF_W Drift_W last_Drift_W WPoZ last_WPoZ Versatz last_Versatz   There is a search at the top reads all the data in.  In every join just a subset of the data is searched again, which is potentially already available from the search at the top.  Therefore I came to the idea to reuse the search on the top as a base search with filtering the individual error codes in the joins.  From my idea, this would reduce the number of searches executed, and therefore speed up dashboard loading. But to be honest, I might be wrong! @bowesmana : I'm not looking for the latest message at all, I'm Looking for the latest message of a group of specific error codes.  Something like  | eventstats max(_time) as last_ZP_Def by ocp fr el where d_id IN ("DIAG_162", "DIAG_164", "DIAG_165", "DIAG_166") would in fact replace one of my joins, but I haven't found a way to properly implement this in SPL.    ... View more