If I add the code below, The table does not populate under PIRStatus column. The status is from the PIR index and is linked to the Change through the FusionLink index. I have provided a screenshot of the table. Not really sure what I am missing. (index=index_prod_sql_ism_change_v2 OR index=index_prod_sql_ism_pir OR index=index_prod_sql_ism_fusionlink) * * * | rename Owner as SamAccountName | lookup AD_Lookup SamAccountName OUTPUT DisplayName, Department | eval SourceId=if(index="index_prod_sql_ism_change_v2",RecId,SourceId) | eval TargetId=if(index="index_prod_sql_ism_pir",RecId,TargetId) | eval PIRStatus=if(index="index_prod_sql_ism_pir",Status,null()) | eval Status=if(index="index_prod_sql_ism_pir",null(),Status) | eventstats values(TargetId) as TargetID by SourceId | eventstats values(PIRStatus) as PIRStatus by TargetId | where index="index_prod_sql_ism_change_v2" | dedup ChangeNumber | table ChangeNumber, Status, Subject, TypeOfChange, Priority, DisplayName, OwnerTeam, Category, ScheduledStartDate, ScheduledEndDate, PIRStatus | sort ChangeNumber | rename ChangeNumber AS Change, Subject AS Summary, TypeOfChange AS "Type of Change", DisplayName AS Owner, OwnerTeam AS "Owner Team", ScheduledStartDate AS "Scheduled Start Date", ScheduledEndDate AS "Scheduled End Date", Status1 AS "PIR Status"
... View more