You should be able to just use a single transaction command: ...|transaction ReqId trackerid | search sourcetype="corps_app_audit" AND sourcetype="corps_app_error" If an event is missing a transaction field (trackerid), but matches on others (ReqId), it will still be included in the transaction. ... View more