Depending on the data, you could do something like index=A cf_app_name=B ((search string 1) OR (search string 2) | rex statement 1 | rex statement 2 | table serial Type Id service _time | stats count values(*) as * by Id | where count > 1 OR | where condition_that_satisfies_the test_for_your_use_case The where clause would be dependent on what your data looks like. For example if each of the data sets is from a different sourcetype, then you could do ... | table serial Type Id service _time sourcetype | stats count values(*) as * by Id | where count>1 AND isnotnull(mvfind(sourcetype, "sourcetype_2")) The two rex statements would appear not to conflict with each other and other than one rex will always fail for one of the data sets, it should work OK Hope this helps   ... View more