Give this a try index=common_index sourcetype=common_sourcetype (EventName=First somethingElse=whatever) OR (EventName=Second) | eval EventNameToUse=if(EventName="First",EventName,null()) | stats dc(EventName) as reportedOnvalues(EventNameToUse) as EventName values(keyField) as keyField by GroupId | where reportedOn=2 | table EventName keyField ... View more

Sorry for the delayed response. After reading through all parts and links in your response, I am still using the 'map' solution. I think you may be right, that ultimately the solution will be to import the actual statsmodel OLS using the method outlined in your last link. ... View more

Yes, your way is definitely the right way and mine will not work at all and I should have realized that. Great job! That's what I get for posting untested answers from my phone! ... View more