I tried using coalesce but no luck.  I am trying to find all domains in our scope  using many different indexes  and multiple joins. I am currently using two separate searches and  both search queries are working fine when executing separately. I want to join both search queries to get complete result. I tried using coalesce with eval Domain in my search where some of  public IP are missing .I want to use Private_IP when Public_IP is not there. Then I plan to Join both queries based on Domain. | eval Domain= coalesce( Public_IP, Private_IP)  . After using coalesce command  new field Domain showing up  empty space as in Public _IP. In other works new filed Domain is replicating Public_IP .  I also tried using if  with eval bit  no luck. | eval Domain=if(isnull(Public_IP),Private_IP, Public_IP).   ... View more