Ah I omitted quotation marks in filter. index IN (index1, index2) | eval field = coalesce(field1, field2) ``` common field name ``` | stats values(index) as indices by field ``` which index contains this value? ``` | where mvcount(indices) == 1 AND indices == "index1" ``` only appears in index1 ``` ... View more

You could use mvdedup (as I suggested in my otherwise incorrect solution) | eval cluster="" | foreach Hosts.*.Cluster [| eval cluster = mvdedup(mvappend(cluster, if(isnotnull('<<FIELD>>'), '<<FIELD>>', cluster)))] | table cluster ... View more

Thanks for the reply @gcusello , I didn't get the desired output it is displaying whole fields from table2 in table3 so here is table1 coming from a dynamic nested json and am using below query to extract it before your eval and stats query         foreach hosts.*.table1 [| eval cluster=isnotnull('<<FIELD>>'),'<<FIELD>>,table1)]     ... View more