Hi Experts, I am trying to find a string pattern "a word" in the primary search from source="123.log" and then from time line of each pattern matching event, i would like to display some 20 events from a different source="456.log", prior to the time of events found from source="123.log". Even join and other subsearches did not help. As shown below, the Primary search is suppressing results to secondary search . index=index1 source="123.log" <pattern to find> |eval date_x=strftime(_time,"%m/%d/%Y:%H:%M:%S") |streamstats count |where count>0 |search index=index1 source="456.log" earliest=date_x|top limit=20 source Please help. Thank you. ... View more

Need to transform like this. Please help. Before: Col1----Col2 Name1---- a ------------b --------c After:` Col1 Col2 Col3 Col4 Name1 a b c ... View more