Hi @Newbie_punk, SPL (Splunk Programming Language) isn't a procedural language, so you havent a construct like if then else. But you can assign a value to a field  based on the condition you defined, e.g. if the same field has different name (e.g. metricA and metricB), you can use: index=aData OR index=bData | eval metric=coalesce(metricA,metricB) | table metric or use the if condition in the eval command index=aData OR index=bData | eval metric=if(index=indexA,metricA,metricB) | table metric Adapt ths approach to your condition. Ciao. Giuseppe ... View more