Your posted code won't work. I don't know what this will do... | where Bill_run like "%M%" ... but it seems like you want this instead... | where like(Bill_run,"%M%") ... and you want it as high in the code as that field can be tested, if I have guessed right, that is immediately before the stats in your code, but it can be moved (along with the rex that extracts it) to right after the searches.. Most of the work in the subsearch can be simplified to a single stats range() presumably, the date in the subsearch has to be the same as EXECUTION_DATE , or there's nothing concrete to connect the two searches. The resulting code looks something like this... host="**" source="*BIP*" NOT source="*BIP98*" NOT source="*BIP99*" | eval path=mvindex(split(source,"-"),0) | eval thread=mvindex(split(path,"/"),-1) | search "BIP CONTROL" | search "TASK MODE: 0" | rex "MISSING\n\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\s+\W+\n(?<Bill_run>[^,\s]+)" | where like(Bill_run,"%M%") | eval EXECUTION_DATE=strftime(strptime(EXECUTION_DATE,"%d %b %Y"),"%Y.%m.%d") | rex "TOTAL\s+ACCOUNTS\s+QUEUED:\s+(?<total_accounts>[^,\s]+)" | rex "TOTAL\s+SUCCESSFULLY\s+PROCESSED:\s+(?<processed>[^,\s]+)" | rex "TOTAL\s+LOCKED/SKIPPED:\s+(?<skipped>[^,\s]+)" | rex "TOTAL\s+IN\s+ERROR:\s+(?<error>[^,\s]+)" | stats sum(total_accounts) as Total_Accounts, sum(processed) as Total_Successful, sum(skipped) as "Total_Skipped", sum(error) as "Total_Error" by Bill_run, EXECUTION_DATE | left join EXECUTION_DATE [search host="****" sourcetype="kenan_pst" | where source like "%pst_pe_arb_bil_run_bip%" | eval mydate=mvindex(split(mvindex(split(source,"/"),-1),"_"),6) | stats range(_time) as time_diff by source ,mydate | eval EXECUTION_DATE = strftime(strptime(mydate,"formate for mydate"),"%Y.%m.%d") | table time_diff EXECUTION_DATE ] | table Bill_run EXECUTION_DATE Total_Accounts Total_Successful Total_Skipped Total_Error time_diff ... View more