I tried using multireport too.
But it is not giving me any statistics table "NO results found" , and no. of events that it shows is also incorrect.
splunk doesn't take "multireport" as key word/library key word/ lib predefined word.
((index="") (sourcetype="Remedy"))
| multireport [ eval Feedback="BLANK RESOLUTION"
|fields "Incident ID", "_time", "Resolution", "Status", "Vendor Ticket Number", "Feedback", "Resolution Categorization Tier"
|search (Resolution != "why did it happen" AND Resolution != "closer") AND Status="Resolved"
|table "Incident ID", "Feedback" "_time", "Resolution", "Status", "Vendor Ticket Number", "Resolution Categorization Tier*"]
[search ((index="" OR index="_") (sourcetype="Remedy")) |eval Feedback="feedback message"
|fields "Incident ID",....
|search ("my search")
|table "Incident ID", "Feedback" ....]
... View more