I have a search that generates two distinct types of record entries (searching for "for event"): 2015-05-05 for event 201216053940303kljdwlj for recipient Geogm 2015-05-05 card 12345678910 for event 201216053940303kljdwlj Fields I created: 201216053940303kljdwlj = eventid Geogm = username (it's always 6 characters long and at the end of the line) 12345678910 = cardnum I want a table that shows the username and eventid of the first type of record and combines it with the card number where the eventid is a match, showing something like the following: Time , username , eventid , cardnum 2015-05-05 , Geogm , 201216053940303kljdwlj , 12345678910 I think I got this working using join, but would like a different way to achieve it due to performance issues of using join. My current query: index=myindex source="source1" OR source="source2" "for recipient" | extract pairdelim="|;,", kvdelim="=:", auto=f | rex field=_raw "(?<username>\s......$)" | search username!="" | rex field=_raw "event (?<eventid>.(\w+))" | search eventid !="" | table _time username eventid | join eventid [search index=myindex source="source1" OR source="source2" "for event" | extract pairdelim="|;,", kvdelim="=:", auto=f | rex field=_raw "card (?<cardnum>.(\w+))" | search cardnum !="" | rex field=_raw "event (?<eventid>.(\w+))" | search eventid !="" | table eventid cardnum] This is simlar to the question shown here: answers.splunk.com/answers/443909/how-do-i-joincombine-my-two-search-searches-to-get.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev but it did not receive an accepted answer ... View more