You can try something like this, though there may be a more efficient way to do it. <Base Search> | eval addr=saddr+":"+daddr | makemv delim=":" addr | mvexpand addr | stats count by addr Basically, you combine the source and destination addresses together and make that a multi-valued field, expand out those values so there's an event for each value, then use stats to group by those new values. ... View more

@dkotowsk, I would say using append, but there is sub-search limitation applicable. index=index_a earliest="30/01/18:00:00:00" latest="30/01/18:00:05:00" dest_ip="10.0.0.1" | append [search index=index_b earliest="30/01/18:10:00:00" latest="30/01/18:10:05:00" dest_ip="10.0.0.1"] Once you have data from two base searches what is it that you need to perform? See if you can use multisearch instead of append. ... View more