First combine both queries: (index=a0_payservutil_generic_app_audit_prd sourcetype="npp:pom:stdout" eventCode="fundsReservationManualInterventionNeeded") OR (index=prod_payments OR index=a0_payservutil_generic_app_audit_prd sourcetype="npp:cbis:techevent" $selected_ID$) Then you need to combine the 2 fields from both searches into one. Then use the coalesce function to fill an ENTITY field with the values of first valid following the order inside function. This should be placed after any eval or regex used to extract these fields. | eval ENTITY = coaalesce(EntityID, instructionReceiptIdentification)   ... View more