Notifications and ChangeNotifications present in both indices and I want to separate them by index type and count them. Looks like searchmatch with AND function seems not working.Is there better way to have these fields seperated by index type. index=service1 OR index=service2 */application/Notification OR */application/changeNotification | eval timeevents=case(searchmatch("Notifcations" AND "index=service1" ),"Service1NewNotification", searchmatch("Notifcations" AND "index=service2" ),"service2NewNotification", searchmatch("changeNotifications"AND "index=service1"), "service1newChangeNotifications", searchmatch("changeNotifications"AND "index=service2"), "service2newChangeNotifications", | stats count by index, timeevents ... View more