I need to display multiple rows having the same PART_NUMBER value for each FLIT_COMPONENTS and AMOUNT sourcetype=flit_info ------ has PART_NUMBER, PLANT_CODE, PALLET_TYPE, DISPATCH_UNIT , CAPACITY , FLIT_RULE_ID sourcetype=flit_comp ----------- has AMOUNT, UPDATED_BY both of these sourcetypes have only one common field which is "ID" in sourcetype="flit_info" AND "FLIT_INSTRUCTION_ID" in sourcetype="flit_comp" . I was able to do stats by combining these two fields in a field only. Code I have used - index=ibldc-db sourcetype="flit_info" OR sourcetype="flit_comp" | dedup ID | rename FLIT_INSTRUCTION_ID as IDc | eval IDs=coalesce(IDc,ID) | makemv IDs | stats list(PART_NUMBER) as PART_NUMBER list(PLANT_CODE) as PLANT_CODE list(PALLET_TYPE) as PALLET_TYPE list(CAPACITY) as CAPACITY list(DU) as DISPATCH_UNIT list(BUNDLE_COMPONENT) as FLIT_COMPONENTS list(AMOUNT) as AMOUNT list(RULE_ID) as FLIT_RULE_ID list(UPDATED_BY) as UPDATED_BY by IDs | table PART_NUMBER PLANT_CODE PALLET_TYPE CAPACITY FLIT_COMPONENTS AMOUNT DISPATCH_UNIT FLIT_RULE_ID UPDATED_BY Results are like - What is expected is that the PART_NUMBER should fill all the rows wherever the FLIT_COMPONENTS are present mulitple rows for each FLIT_COMPONENTS , that is the same values of the PART_NUMBER and the rest of the columns should be individual rows so that if we download the report in excel each row will have PART_NUMBER and FLIT_COMPONENTS I need your inputs on how to build this query? ... View more