@octavioserpa, From the above search,you get all the events which have both MID and ICID in values(_raw). So if you could lets know what's the final output after you get "3" events which are matching, then we can try that directly. Transaction is bit expensive in terms of resource utilization. But if you can't avoid transaction, try this with sample events and lets know if it works. index="your index" |"your field extractions" |eventstats values(MID) as MID_MISSING by ICID|eval MID=coalesce(MID,MID_MISSING ) |eventstats values(ICID) as ICID_MISSING by MID|eval ICID=coalesce(ICID,ICID_MISSING ) |transaction MID,ICID ... View more

@octavioserpa, if any of the answers helped you , please accept /upvote or comment here if you need further assistance ... View more