Hi pmgahan, sorry I did an error in subsearch, try: index=your_index | rename IDCategory AS ID_Key | join ID_Key [ search index=your_index | rename ID AS ID_Key Name AS Category_Name | fields ID_Key Category_Name ] | search Category_Name=* | table ID Name Type ID_Key Category_Name it should run after try index=your_index IDCategory=* | rename IDCategory AS ID_Key | join ID_Key [ search index=your_index NOT IDCategory=* | rename ID AS ID_Key Name AS Category_Name| fields ID_Key Category_Name] | table ID Name Type ID_Key Category_Name that should be quicker. Bye. Giuseppe ... View more