Hi @AbhinavRanjan, how dinamic data source fields are generated? is it possible for you to use a different name? if not you have to manipulate your multivalue to always take the first or the second, something like this: ... | eval source=mvindex(source,0) | table _time,cluster_name,namespaceName,podName,policyName,message, severity,action,tags,resource,source, Ciao. Giuseppe ... View more