I've spent over a month reading on here and trying to do this myself, but it's time to throw up the white flag. I've got two indexes: Index=Main1 contains fields code_ID, domain Index=Main2 contains fields code_ID, user code_ID is a common field between both indexes. What I need to do is search index=Main1 for a certain pattern of text (index=Main1 "abcdefg"), which will return the code_ID and domain fields. Then, I need to take the code_ID that was retrieved from this search and search index=Main2 for an event that contains the same data. In one of those events, there will be a field called user that does not exist in index=Main1. I need to display a table with the code_ID, domain and user fields. So far, everything I've done has produced an empty user field column. Thanks in advance for your help. ... View more