Thanks @gcusello I tried to run a query something like this: | inputlookup incident_updates_lookup | eval source_guid_in_lookup=mvindex(split(rule_id, "@@notable@"), 0) | join type=left source_guid_in_lookup [ search index=notable | rename source_guid as source_guid_in_lookup ] | table rule_id, source_guid_in_lookup, source_event_id, status By this, I want to fetch the source_event_id(notable_id). If I split the rule_id at "@@notable@" the first part would match the source_guid field in notable index. But when I ran this query, I was not able to get any source_event_id. That column returns no entry. Could you please help me to modify this query?
... View more