I tried the following query: index=alldata Application="AZ" |eval Date=strftime(_time,"%m/%d/%Y %H:%M:%S %Z") |table Date user username |rename user as User, username as id |dedup id |appendcols [search index=infor |fields disName userPrin |table disName userPrin |rename disName as Name userPrin as Mail |dedup Mail ] |fields Date User id Mail Name |eval "Login Status"=case(id==Mail, "Logged in", id!=Mail, "Never Logged in") |eval Result=if(id=Mail, "Mail", "NULL") I would like to create a column in the table that compares values in column id and Mail  and lists unique values (non duplicate). ... View more