Trouble tabling email details

[hawkeyesc72]

I want to build a small dashboard that offers a quick view into emails a user has recently received. If I use this, I can get the sender address tabled properly:
(1).    index=office365
          | table P1Sender
          | search P1Sender=*


If I use this, I can get recipient count, recipient names and subject tabled properly:

(2).     index=office365
            | table Item.RecipientsCount, Item.Recipients{}.Name, Item.Subject
            | search Item.Recipients{}.Name=*, Item.Subject=*

My problem is I cannot get them tabled together in the same results view. If I try and add P1Sender to the (2) SPL table, I get an empty column. If I add P1Sender=* to the (2) search statement I get 0 results in every column.

Any advice? Screenshots of SPL and results in replies.

[ITWhisperer]

Your events do not have values for P1Sender at the same time as values for the other fields you are searching on. You need to find a field that has corresponding values in both sets of events so you can correlate the data. As @PickleRick says, we have no idea what your data looks like!

[PickleRick]

Ok. From the top.

1. What does your data look like? We have no idea what is in your events. From our point of view the info might simply not be available within the same events.

2. As a rule of thumb the table command should not be used anywhere else but at the very end of your search to transform your results to... well, a table for presentation purposes. It's not meant to be used mid-search.

Point 2 is a "good practice" remark but probably it's because of p.1 - your data itself.

[hawkeyesc72]

 Adding P1Sender to search statement blocks everything and nothing gets returned.

[hawkeyesc72]

 Recipient count, recipient names and subject all work as well. But trying to add in P1Sender, nothing happens.

[hawkeyesc72]

P1Sender by itself works. I blocked out most of the information for privacy reasons.