And, if you want to add the results of different searches to your results, then there are more options. Append - (your existing search) | table trkid myvalues | append [index=foo your new search | stats count as new_col by trkid] | stats values(*) as * by trkid | table trkid myvalues new_col Join - (your existing search) | table trkid myvalues | join type=left trkid [index=foo your new search | stats count as new_col by trkid] | fillnull value=0 new_col | table trkid myvalues new_col Map - (your existing search) | table trkid myvalues | map search="search index=foo trkid2=$trkid$ | your calculations | eval myvalues=\"$myvalues$\"" | table trkid myvalues new_col MANY more options... ... View more

I've never tried it in the middle of a search before, i've always tacked it onto the end if there were no results, but this is my method for that: | appendpipe [ stats count | eval message="There is no data for this time period." | where count==0 |table message] Let me know if that works in the middle of your search or what happens if it doesn't. ... View more