# error when creating searches **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [March 13, 2018, 1:44pm UTC](https://community.graylog.org/t/error-when-creating-searches/4546 "2018-03-13T13:44:17Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![rodrigogriffo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rodrigogriffo/32/1949_2.png) [@rodrigogriffo](https://community.graylog.org/u/rodrigogriffo)\ **Post date:** [March 13, 2018, 1:44pm UTC](https://community.graylog.org/t/error-when-creating-searches/4546/1 "2018-03-13T13:44:17Z")
Sorry for english but I use google translate. I started using Graylog in a short time especially to extract logs from pfSense Firewall. I have a pfSense that acts as a Captive Portal for a college and I am needing to log the access log for a while. I made some extracts and it is taking care of me, I used the GROK that is available in the marketplace for pfSense and everything is alright. Now I have to do some research so that I can get back what I want. I did a search to ONLY deliver the users logged in with the date / time and ip and this is ok. I did using the SPLIT of the “message” and when it is necessary I do the following search: \_exists \_: “login\_user” AND NOT nginx When I need to know an ip that was accessed I put: DestIP: “ip of destination” I have my answers separated … now I would like to “join” the searches or I want to know which user accessed which ip Ex. DestIP -\> login\_user But I can not do it … I tried the following ways … DestIP: “destination ip” AND \_exists \_: “login\_user” \_exists \_: “destination ip” AND NOT nginx && DestIP: “destination ip” I’ve tried it in other ways and still can not … I ask for the help and thank you. Att. Rodrigo Griffo ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 13, 2018, 1:44pm UTC](https://community.graylog.org/t/error-when-creating-searches/4546/2 "2018-03-13T13:44:47Z")
Duplicate of [Graylog Research](https://community.graylog.org/t/graylog-research/4534)