Try this.
<your base search> | eval username=coalesce(UserId, Ticket_no)
| stats values(*) as * by username
hi @Khuzair81 , is there a common value between these two events, like how would you decide to merge these events, is this based on timestamps ? Also, you are trying to do this during search time right ?
There is one thing common in both event but the column name is different.
Event1 : Ticket_no - username123,
Event2 : Ticket_no. - TKT123, UserId - username123