I am producing data like this in an alert that will throw an email, which is needed. I'm attempting to control the email Subject and Message. I need to make an adjustment though. If all of the statuses are "SUCCEEDED" then I need to show that in the Subject and in the message. However, if any of the status are something other than "SUCCEEDED" then I need the Subject and the message to show that. NOTE: There will always be 5 items; That part is working as needed. item Status Message 1 SUCCEEDED Success Message 2 SUCCEEDED Success Message 3 SUCCEEDED Success Message 4 FAILED Failure Message 5 SUCCEEDED Success Message Approach creating the above | eval subject= if(status="Failure","FAILED","SUCCEEDED") | eval message= if(status="Failure","Failure Message","Success Message") | rename affected_ci as URL, subject as Status, event_date_time as Date | table item, status, message, What I'm needing is item Status Message Subject_Value Email_Message 1 SUCCEEDED Success Message Failure Failure Message 2 SUCCEEDED Success Message Failure Failure Message 3 SUCCEEDED Success Message Failure Failure Message 4 FAILED Failure Message Failure Failure Message 5 SUCCEEDED Success Message Failure Failure Message The idea here is, I need to pass the subject and email message into every row, then use the $result.Subject_Value$ and $result.Email_Message$ in the appropriate field. ... View more