I am trying creating a report that will run on schedule which combines different sourcetype to run from the datamodel like below. | datamodel Email All_Email search | search sourcetype = "ms0365log OR sourcetype = "emaillog" OR sourcetype=exchange2019 OR sourcetype=maillog In the sourcetype=maillog i want during the search to exclude any maillog event that has final_rule!=scanning from the result. When I run the below command for one sourcetype it works well, but when I add the mutiple source type like above it fails. Single sourcetype works fine | datamodel Email All_Email search | search sourcetype = "maillog" |spath final_rule | search final_rule!=scanning Multiple sourcetype fails | datamodel Email All_Email search | search sourcetype = "ms0365log OR sourcetype = "emaillog" OR sourcetype=exchange2019 OR sourcetype=maillog "|spath final_rule | search final_rule!=scanning" | any ideas and I don't mind removing spath ... View more