We're using this query to retrieve metrics on our hosts:   index=_internal source=*metrics.log group=tcpin_connections | eval sourceHost=if(isnull(hostname), sourceHost,hostname) | rename connectionType as connectType | eval connectType=case(fwdType=="uf","univ fwder", fwdType=="lwf", "lightwt fwder",fwdType=="full", "heavy fwder", connectType=="cooked" or connectType=="cookedSSL","Splunk fwder", connectType=="raw" or connectType=="rawSSL","legacy fwder") | eval version=if(isnull(version),"pre 4.2",version) | rename version as Ver | dedup sourceIp | table connectType, sourceIp, sourceHost, Ver   This gives us everything we need, except for what indexes these hosts are sending data to. I'm aware of this query to retrieve the indexes and the hosts that are sending data to them:   |tstats values(host) where index=* by index     How can I combine the two, either with a join or a sub search where in the table output, we have a column for index, which would give us a list of indexes the hosts are sending to?     ... View more