Hi @asingh4177, it isn't so fully clear your need and especially your need, but anuway I can give you some hint about your search: at first fields like "Resources{}.Agent.AgentName" sometimes (espcially in eval commands) have problems, so, after the main search I hint to rename it in something without dots. then if you have a a field in each index with the same content you could use eval=coalesce() to have only one field to use in grouping stats command, e.g.  | rename Resources{}.ReservationGroups AS ReservationGroups | eval reservation_group=coalesce(ReservationGroups, reservation_group) at least, after a stats command you have only the fields contained in the stats, in your case you have only count and ReservationGroup, but, if you rename count AS pp_count , you don't still have the count field that you used in the following eval command. As I said it isn't so clear your need: you spoke of two indexes, but you use only one in search. Could you better explain your need? Ciao. Giuseppe ... View more