Try this index=whatever eventtype=whateversourcetype |table UserName, "B's fields", "A's fields" eventtypes.conf [whateversourcetype ] search = sourcetype=A OR sourcetype=B or From GUI: settings->Event types-> new Name=whateversourcetype Search String=sourcetype=A OR sourcetype=B ... View more