Hi @priyastalin, I am not going to be able to go through every possible use case you run into.  I will provide you with a concept that should carry through on any use case with the data you've been working with. In general you want to wrap your different base search criteria with parenthesis and with OR between the groups of parenthesis's.  You need to identify the correlating field, which in all of of your use cases thus far have been deviceId.  You then need to create a stats that will pass through all of the fields you require using "latest(fieldname) as fieldname" and that passes in the values of the sourcetypes with "values(sourcetype) as sourcetype" to ensure you are getting data from both data sets.  You then add a search line after the states that ensures you are getting both sourcetypes.  Now you can do anything you would like to the resulting data as you normally would have with your join.  Walking through these concepts with your latest example would be making your first line the two different data sets wrapped in parenthesis separated by OR: index=167515-np (sourcetype=hardware physicalType=Chassis) OR (sourcetype=group_members groupId=288348) You then define the fields that will be passed through: | fields deviceId productType productId physicalType sourcetype You then create a stats that provides the latest values for all fields of interest by the key field used for joining , which is deviceId, and that provides all values of the field that will let us know what source it's from, which is sourcetype: | stats latest(productType) as productType latest(productId) as productId latest(physicalType) as physicalType values(sourcetype) as sourcetype by deviceId Then you add a filter that ensures only data that appears in all of the selected data sources , which in this use case is using sourcetype, are being returned: | search sourcetype=hardware sourcetype=group_members You now have the fields you need from the two data sets and only data that exists in both data sets. ... View more

I was informed that it's sourcetypes and not in the _raw.  Here's the adjusted solution: index=168347-np ([| `last_np_sourcetype("index=168347-np","hardware")`] (physicalType=*)) OR ([| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681) | fields physicalElementId deviceId sourcetype | stats values(sourcetype) as sourcetype values(physicalElementId) as physicalElementId by deviceId | search sourcetype=hardware sourcetype=group_members | stats dc(physicalElementId) as Devices ... View more

Hi @Ingo, The simplest way to do this with javascript would be to create a button input that on click sets a token that is present in all of your other searches.  You can also do this with simplexml, but it will add the token to the url when they click submit and I'm guessing you don't want that. The below javascript will set a token defined with a name of "submitbutton" and a value of "*".  This value will only be set when clicking html submit button created in the xml.  In order for this to work you need to add "| search $submitbutton$" anywhere after the first line of your search and it will then prevent the search from running until the button is pushed. Javascript for submitbuttontoken.js:   require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function (_, $, mvc) { // Initialize Default and Submitted Token Model. var defaultTokenModel = mvc.Components.get("default"); var submittedTokenModel = mvc.Components.get("submitted"); // #submit button Clicked $(document).on("click", "input#submitbutton", function (e) { // Default Token Model update For token value in UI defaultTokenModel.set("submitbutton", "*"); // Submitted Token Model update For running searches on Dashboard with Submit Button. submittedTokenModel.set("submitbutton", "*"); }); });   And here's a run anywhere example that uses that:   <dashboard script="submitbuttontoken.js"> <init> <unset token="submitbutton"></unset> </init> <label>demodash</label> <fieldset submitButton="false" autoRun="false"> <input type="dropdown" token="Input1"> <label>Input1</label> <choice value="A">A</choice> <choice value="B">B</choice> </input> <input type="dropdown" token="Input2"> <label>Input2</label> <choice value="C">C</choice> <choice value="D">D</choice> </input> <html> <input type="button" id="submitbutton" class="btn btn-primary" value="Submit"></input> </html> </fieldset> <search> <query>| makeresults count=1 | search $submitbutton$ | eval search=if("A"=$Input1|s$ AND "C"=$Input2|s$, "| makeresults | eval x=\"No\" | table x", "| makeresults | eval x=\"Yes\" | table x") | table search</query> <done> <condition match="$job.doneProgress$=1"> <set token="query">$result.search$</set> </condition> </done> </search> <row> <panel> <table> <search> <query>$query$ | search $submitbutton$</query> </search> </table> </panel> </row> </dashboard>     ... View more

You could create a somewhat complicated SECMD in your props.conf to map it, but then you are adding to your license usage unnecessarily.  I believe it makes more sense to turn that data from the url your linked into lookup files that return the definition.  I will provide you with queries that will build the lookup files after I copy/pasted the data from that link. First is the ClaimType definitions:   | makeresults | fields - _time | eval data=" \"#\" for a user logon name \".\" for an anonymous user \"5\" for an email address \"!\" for an identity provider \"+\" for a Group security identifier (SID) \"-\" for a role \"%\" for a farm ID \"?\" for a name identifier \"\\\" for a private personal identifier (PPID) \"e\" for a user principal name (UPN) \"\"\" for a user ID \"$\" for a distribution list security identifier (SID) \"&\" for a process identity security identifier (SID) \"'\" for a process identity logon name \"(\" for an authenticated user \")\" for a primary security identifier (SID) \"*\" for a primary group security identifier (SID) \"0\" for an authorization decision \"1\" for a country \"2\" for a date of birth \"3\" for a deny only security identifier (SID) \"4\" for DNS \"6\" for a gender \"7\" for a given name \"8\" for a hash \"9\" for a home phone \"<\" for a locality \"=\" for a mobile phone \">\" for a name \"@\" for other phone \"[\" for a postal code \"]\" for RSA \"^\" for a secure identifier (SID) \"_\" for a service principal name (SPN) \"`\" for a state or province \"a\" for a street address \"b\" for a surname \"c\" for a system \"d\" for a thumbprint \"f\" for a uniform resource name (URI) \"g\" for a web page" | makemv data tokenizer="(?<data>[^\n]+)" | mvexpand data | rex field=data "\s+\"(?<ClaimType>.+)\" for\s+((a|an)\s+)?(?<ClaimTypeDefinition>[^\e]+)" | fields ClaimType ClaimTypeDefinition | outputlookup IISClaimTypeLookup.csv   Then is the ClaimValueType definitions:   | makeresults | fields - _time | eval data=" \".\" for a string \"+\" for an RFC 822-formatted name \")\" for an integer \"\"\" for a Boolean \"#\" for a date \"$\" for a date with time \"&\" for a double \"!\" for a Base64 formatted binary \"0\" for a X.500 formatted name" | makemv data tokenizer="(?<data>[^\n]+)" | mvexpand data | rex field=data "\s+\"(?<ClaimValueType>.+)\"\s+for\s+((a|an)\s+)?(?<ClaimValueTypeDefinition>[^\e]+)" | fields - data | outputlookup IISClaimValueTypeLookup.csv   Finally the Auth Mode:   | makeresults | fields - _time | eval data=" \"w\" for Windows claims (no original issuer) \"s\" for the local SharePoint security token service (STS) (no original issuer) \"t\" for a trusted issuer \"m\" for a membership issuer \"r\" for a role provider issuer \"f\" for forms-based authentication \"c\" for a claim provider" | makemv data tokenizer="(?<data>[^\n]+)" | mvexpand data | rex field=data "\s+\"(?<AuthMode>.+)\"\s+for\s+((a|an)\s+)?(?<AuthModeDefinition>[^\e]+)" | fields - data | outputlookup IISAuthModeLookup.csv   Now you need to be able to extract each of those fields from your raw data and turn them into fields.  The below extraction will pull those fields as long as there is a space followed by a 0 then the data that matches what is in the url you attached:   | rex "\s0(?<ClaimType>[\!\"\#\$\%\&\'\(\)\*\+\-\.\0\1\2\3\4\5\6\7\8\9\<\=\>\?\@\[\]\^\_\`\a\b\c\d\e\f\g\\\])(?<ClaimValueType>[\.\+\)\"#\$\&\!0])(?<AuthMode>[wstmrfc])\|((?<OriginalIssuer>[^\|]+)\|)?(?<ClaimValue>[^\s]+)"   After you generate those lookup tables in the first three queries you can use them in combination with the above extraction to produce definitions for each of those codes:   | makeresults | eval Data="192.168.2.72 GET /_vti_bin/client.svc/web/title - 443 0#.w|domain\login 192.168.52.48 Mozilla/5.0" | rex field=Data "\s0(?<ClaimType>[\!\"\#\$\%\&\'\(\)\*\+\-\.\0\1\2\3\4\5\6\7\8\9\<\=\>\?\@\[\]\^\_\`\a\b\c\d\e\f\g\\\])(?<ClaimValueType>[\.\+\)\"#\$\&\!0])(?<AuthMode>[wstmrfc])\|((?<OriginalIssuer>[^\|]+)\|)?(?<ClaimValue>[^\s]+)" | lookup IISClaimTypeLookup.csv ClaimType | lookup IISClaimValueTypeLookup.csv ClaimValueType | lookup IISAuthModeLookup.csv AuthMode   ... View more

The problem is you are converting an epoch time back into text before performing your delta between the two dates when you do a strftime after the strptime.  You can actually just use one eval to accomplish what you are looking for:   | eval "Duration"=round(abs((relative_time(now(), "@d")-relative_time(strptime(project_submit_date,"%Y-%m-%d %H:%M:%S"), "@d"))/86400),0)     ... View more