Like this: (index=foo AND source=foo) OR (index=bar AND source=bar) | eval joiner = mvappend(mvappend(fieldA, fieldB), fieldC) | fields - fieldA fieldB fieldC | stats values(*) AS * BY joiner ... View more