AHH man i was not thinking about this right, those are not field names in the first search, the fields would be search_name and count. The only way I can think of doing this right now is like this, and please someone tell me better way to go about this. (index=sentrion-summary-fine search_name="Firewall Block") OR (index=sentrion-summary-fine search_name="Summarize Message Categorization, Disposition by 30min" disposition="Deliver" cluster="cluster_1") | stats count AS theCount by search_name | sort + search_name | transpose | search NOT column=search_name | rename row1 AS FB | rename row2 AS SMC | eval newvalue=FB-SMC | table FB SMC newvalue ... View more

This work for me. Thank you very much! ... View more