hi @yuanliu thanks for tips, i tried running with the modified query. i got the results for ORDERS which are NOT AVAILABLE (which is the resultant of First search) . my requirement is to match ORDERS which are NOT AVAILABLE with ORDERS in second log . and display ORDERS  and UNIQUEID   sharing the data here  INFO [pool-9-thread-3] CLASS_NAME=Q, METHOD=, MESSAGE=response status for TransNum: 629f2ad - 400 | Response - {"code":0001,"message":"Not available","messages":[],"additionalTxnFields":[]} INFO [pool-9-thread-7] CLASS_NAME=Q, METHOD=, MESSAGE=Request for TransNum: 629f2ad - {"address":{"billToThis":true,"country":"","email":"******************","firstname":"FN","lastname":"LN","postcode":"0","salutation":null,"telephone":"+999999999999"},"deliveryMode":"","payments":[{"amount":10,"code":"BFD"}],"products":[{"currency":356,"price":600,"qty":2,"uniqueid":"QSTRUJIK"}],"refno":"629f2ad","syncOnly":true}   ... View more

hi @gcusello  i tried your approach , i'm getting results  for all ORDERS.  i want only the ORDERS and UNIQUEID from subquery to be displayed  which matches the ORDERS (in the outer query)  those  Not available  ... View more

hi @gcusello  I have shared the details, could you check    ... View more

hi @gcusello  thanks for your inputs, i have some correction in my query. in the outer query i am trying to pull  the ORDERS which is Not available .I need to match the ORDERS  which is Not available to with the ORDERS on Sub query.  Result to be displayed  ORDERS  & UNIQUEID .  common field in two query is ORDERS  Below is the query i am using  index=source "status for : *  | "status for : * " AND "Not available"  | rex field=_raw "status for : (?<ORDERS>.*?)" | join ORDERS [search Message=Request for : * | rex field=_raw "data=[A-Za-z0-9-]+\|(?P<ORDERS>[\w\.]+)" | rex field=_raw "\"unique\"\:\"(?P<UNIQUEID>[A-Z0-9]+)\""] | table ORDERS UNIQUEID ... View more

above query produce results for all the ORDERS &UNIQUEID . my subquery fetches ORDERS & UNIQUEID i am trying to match the ORDERS in subquery with the outer query, and result display should be  ORDERS & UNIQUEID.   the common field in two query i am using is ORDERS  ... View more

here is the splunk query i am trying to use, Common field in 2 query is ORDERS   index=source "status for : * " | rex field=_raw "status for : (?<ORDERS>.*?)" | join ORDERS [search Message=Request for : * | rex field=_raw "data=[A-Za-z0-9-]+\|(?P<ORDERS>[\w\.]+)" | rex field=_raw "\"unique\"\:\"(?P<UNIQUEID>[A-Z0-9]+)\""] | table ORDERS UNIQUEID     ... View more