Stop thinking SQL; try this: (index="cf-pci" cf_app_name="order-event-publisher*" "Posted event message for OrderId*") OR (index=pt-supply-chain-visibility sourcetype=scv-listener-oms:application:access "message.data.status"=processed) | rex "Posted event message for OrderId (?<OrderNo>[A-Z0-9]*), versionId (?<VerId>[0-9]*)" | eval return = colesce(OrdNo,message.data.domainId) . "/" . colesce(VerId, message.data.versionId) | stats dc(index) AS index_count values(index) AS index BY return | where index_count==1 ... View more