Hello Mr. Galloway, I have slightly modified your query and it works fine. I wanna thank you for your help. Appreciate. Regards, Thomas ... View more

Hello Mr. Galloway, thank you very much, but your query seems it takes into consideration always either index1name or index2name, but not both. In general, i need this query for the following: The main index must always be Index1name. so the query will check index1name and field DNS_domain. Once this first step id done, it will then check Index2name. If Index1name DNS_domain contain equals Index2name query, than query supposed to result to show IP address 2 from Index2name. If this is no clear, so I will give you a practical example. Our detection system (Index1name) detects, that internal computer hits malicious Internet site (DNS_domain). IP address of the internal computer is not present Index1name IP address 1 field and we must go to detection system 2 (Index2name), find the same malicious domain (Index2name query) as it has been in Index1name DNS_domain. Once equals, then write query result to show IP address 2 from Index2name. I appreciate your help. Regards, Thomas ... View more