I have the following search: index=cashflow host=atm source=income OR source=outcome | eval accountStatus="Income: " + transactionIncome + " and Outcome: " + transactionOutcome | table accountStatus I have validated that | table transactionIncome transactionOutcome works, meaning that I see the values of each field in separate columns, but it does not work combining them in a single column called accountStatus as the query would. Why is this? I am also not able to do a column with the sum of [ transactionIncome + transactionOutcome ]. What have I not understood? EDIT: Okay so apparently you can't add the value of a field from one event with the value of a field in another event. How would one go about this? transactionIncome and transactionOutcome are generated from different sources and are not within the same event. ... View more