I think i got the solution. I want to know who is experiencing the slow requests and what is the cleartext name of the slow request. Therefore i startet with the slow request and joined the name using the ip nummer and with a second join I joined the cleartext handler name using the uuid sourcetype="log4j""INFO - slow GET request" | join ip [search "INFO - authenticated user "] | join uuid [search "INFO - Registering handler for"] | table date_year date_month date_mday date_hour date_minute date_second user_name func_name slow_func_time all the fields like ip, uuid, user_name etc. were defined in advance. the field ip and uuid had to be defined twice once for the slow get record and once for the authentication record. The same with the uuid i defined one for the slow get record and one for the register handler record. Thank you so much for your help! ... View more