Hello, I am currently trying to relate "front" logs to "back" logs depending on their sessionIds and their timestamps in order to understand the errors I am getting (putting face to face "front results" and "back results") . The logic "flow" is as follows : I am looking for service A logs that returned a 400 http code ("front" logs, so I need to be within my first index : let's call it front_index) For each log (one log = one error that occured), I want to extract its timestamp and its sessionId For each row I am getting, I want to be able to look for "back" logs (which means I am switching to my second index : let's call it back_index) depending on the timestamp and the sessionId. Each "front" logs can have several "back" logs. Finally, I want to be able to print some details such as the timestamp, the sessionId, some detailed errorCode if present, count if relevant, etc... But that's not the point 🙂 If I am doing it manually, here are the two searches I am running : search 1 : index=front_index sourcetype=access_combined "/url/of/my/service" http_response_code=400 results 1 : list of log where I can manually extract the sessionId and the timestamp of each log I want to analyse search 2 : index="back_index" ** ** results 2 : I am getting different kind of logs that I manually read in order to extract the information I am looking for This work well, but on large amount data, it's just.. not the way it should be done 😛 So here is what I tried in order to help me going faster : search 3 : index=front_index sourcetype=access_combined "/url/of/my/service" http_response_code=400 | table hour, minute, sessionId | map search="search index=back_index $hour$:$minute$ $sessionId$ | table _timestamp, session, errorCode" expectation : I am expecting the first part to extract for each log found the hour, the minute and the sessionId in the front_index and it seems to be fine but then I want the second search to iterate on each row of the first one and to look for all the logs it can find in the back_index related to the timestamp (the minute is precise enough as my timestamps logs don't always perfectly match) and the sessionId. My issue seems to be that I can't change the index I am working on. Every data I retrieve are from the front_index even if I know the data I am looking for are there. A first step would be to get data from both indexes in the final list of events (or at least from the back_index as this is from there that I will get the details I want). And I can't figure why I can't do that. I tried to use wildcards in order to search in both indexes as their names are partially the same, but it does not seems to work. I tried to look the different subjects related to the map command, but I did not find what could help me (or I missed it) or worse, I totally misunderstood something about the command. The map command seems to be the right way to do what I am trying to do, but.. if there is a better/simpler way, I am also interested of course. Thanks for your help, b ... View more