I found the answer below at Stack Overflow: http://stackoverflow.com/a/41109872/5415084 You want to use the transaction filter here, http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Transaction This won't gracefully merge your json in _raw, but it will make the properties available to query/chart upon. In this example, I assume you want to merge events by the time property, since that is the only matching field. sourcetype=test_drive (DO THE MAGIC) | eval first_distance=distance(#44) | eval second_distance=distance(#323) | transaction time | table time first_distance(#323) second_distance(#44) ... View more