Hi, I tried in same way, but not working index=my_index type=outer OR type=inner |rename msg.* AS * | eval joiner=if(type=outer, _id, source_id) | stats values(*) as * by joiner | where ticket_num=TicketNum |table event_id, serial_id Can you please help me here @dmarling
... View more