Hi @SplunkNewbie132, you can use the solution from @yuanliu or use a more structured solution. You should create an eventtype for each data source, e.g. for Windows EventID 4625 has fail password from ssh per minute sourcetype="wineventlog:security" OR source="/var/log/auth.log" host="CLIENT1-DESKTOP" OR host="client3-kali" Account_Name=client1 failed password* and for Linux; index=* sourcetype="wineventlog:security" OR source="/var/log/auth.log" host="CLIENT1-DESKTOP" OR host="client3-kali" OR user=* failed password* then you can run a simpler search like this: eventtype=windows OR eventtype=linux | bucket span=1m _time | stats values(EventCode) AS EventCode by _time host source Obviously there are fields (as EventCode9 that are present in only one OS so they will be empty in the linux rows. If you have fields with the same content but different name (e.g. process and Caller_Process_Name) you can use a rename or an alias: eventtype=windows OR eventtype=linux | bucket span=1m _time | stats values(EventCode) AS EventCode by _time host source | eval Caller_Process_Name=coalesce(process,Caller_Process_Name) Ciao. Giuseppe   ... View more