I can't return _raw data from subsearch as below , but i can find this raw data if i use it in separate main search . I'm able to get _raw data when this join was not working properly if i remove ESBDPUUID from main search. index=esb_dev earliest=-14d@d latest=@d sourcetype="datapower_audit" status="FAILURE" OR STATUS="ERROR" |stats values(ESBDPUUID),values(status),count by ESBDPUUID,host,svc_bp_name _time | join type=left ESBDPUUID[search index=esb_dev sourcetype="datapower_Error" |table _raw ] this is not displaying the result but when i remove table _raw then i can see the result well. ... View more