I'm new, have had no training. I have two distinct logs from same index and sourcetype. In the first log I want to filter by field A and transform field B with upper(replace(B,":","")). I then want to join to field X in the second log where X=upper(replace(B,":","")) so that I can retrieve the value of field Y in the second log. I have tried many things and scoured this forum for clues but am now stuck. Here is one of my many failed attempts: index=its sourcetype=syslog dhip="100.200.300.406" | eval dhmacUP=upper(replace(dhmac,":","")) | append [search index=its sourcetype=syslog rmac=* ] | fields dhip, ruid, rmac, dhmacUP | transaction rmac dhmacUP ... View more