@lucy2019first, your search request contains typo in "action" field sourcetype=abcd user=john ation=login and I'm not sure but the mistake seems to be what you use stats count(action) after table without action field. Did you check the request in a regular search? ... View more

Rockin' cool, @jacobevans! Thanks for the answer. But when we adapted it for our data, we faced the new issue: the long-time request, where appending >2M events from the table 2 is taking most of the time. Is any decision (may be architectural) for this one? ... View more