Hi, We have requirement where we have to get the start till end log of one process and when we get the log we can see the logs of other process as well which is running in parallel. So we want to get the lines of only the process which we have to work on. The process number changes at every run. Sample Log: 2022-02-14 02:30:00,046 [Worker-3] DEBUG User job started 2022-02-14 02:30:00,063 [Worker-3] DEBUG Calling importData 2022-02-14 02:30:00,063 [Worker-3] DEBUG Initializing External DB connection 2022-02-14 02:30:00,065 [Worker-2] DEBUG another process started 2022-02-14 02:30:00,067 [Worker-3] DEBUG url before binding 2022-02-14 02:30:00,082 [Worker-2] DEBUG ExistingAccount 2022-02-14 02:30:00,083 [Worker-2] DEBUG query is array 2022-02-14 02:30:00,097 [Worker-2] DEBUG Done.... assigning access for account 2022-02-14 02:30:00,524 [Worker-2] DEBUG closing connection 2022-02-14 02:30:00,547 [Worker-2] Task Complete 2022-02-14 02:30:00,560 [Worker-3] DEBUG inside finally... 2022-02-14 02:30:00,567 [Worker-3] DEBUG sending Notification Email 2022-02-14 02:30:00,567 [Worker-3] DEBUG User job ended we have used below search to get above log : index=test sourcetype=debugLog | transaction startswith="User job started" endswith="User job ended" we want the output as below. So how we can add extra logic to above search to get below output? 2022-02-14 02:30:00,046 [Worker-3] DEBUG User job started 2022-02-14 02:30:00,063 [Worker-3] DEBUG Calling importData 2022-02-14 02:30:00,063 [Worker-3] DEBUG Initializing External DB connection 2022-02-14 02:30:00,067 [Worker-3] DEBUG url before binding 2022-02-14 02:30:00,560 [Worker-3] DEBUG inside finally... 2022-02-14 02:30:00,567 [Worker-3] DEBUG sending Notification Email 2022-02-14 02:30:00,567 [Worker-3] DEBUG User job ended
... View more