This is amazing, I have been searching for something like this for awhile. I really appreciate it. Here is the solution that worked for my use case index=index_a (sourcetype=source_a OR sourcetype=source_b) | user_a=if(sourcetype=="source_b",user_b,user_a) | stats dc(sourcetype) as sourcetypeCount values(source_b_field) by user_a | where sourcetypeCount = 2 ... View more