Hi I know its 4 years later but found this thread while looking for a solution and thought I show how I made work source=access AND (user != "-") | rename user AS User | append [search source=access AND (access_user != "-") | rename access_user AS User] | stats dc(User) by host I created one search and renamed the desired field from "user to "User". Then I did a sub-search within the search to rename the other desired field from access_user to USER. Then just stats count by new field name and gave me desired output. ... View more