Hello! First a question. How do you use your starttimeu=$starttime$ endtimeu=$endtime$ ? I think, for it to work, you must have something like this bellow, with starttime and endtime as fields in your index1 events: index=index1 host=server* EventCode=1234 starttime=... endtime=....| map search="search index=index2 host=server* errortext starttimeu=$starttime$ endtimeu=$endtime$" | stats count(host) by host And, starttimeu and endtimeu must be fields int your index2 events, and must respectively have same values with starttime and endtime. If that is not the case, remove that starttimeu=$starttime$ endtimeu=$endtime$ in your code. Ok. To capture the host names, that is what you can do. index=index1 host=server* EventCode=1234 | map search="search index=index2 host=$host$ errortext" | stats count(host) by host here is one example with the _internal and _audit indexes. index=_internal sourcetype=* user=*|map search="search index=_audit user=$user$" error|stats count(user) by user ... View more