I have a solution that works - but I am not crazy about the method used. I would prefer to not have to rename the fields because this adds a lot of steps as the number of searches increase. | search1 | appendcols [ |search2 | rename day_of_week as day_of_week2 ....etc..] | where day_of_week!=day_of_week2 ...etc I wanted to post this for someone else that gets stuck on the same problem. I hope it helps someone and if there is a better way I would love to know what it is.
... View more