You should be able to combine it all in one go:
index=ndx (souerce=source1 OR source=source2)
| rex field=_raw "Naam[^:]+:\s(?<user1>\S+)
| rex field=_raw "User:(?<user2>\S+)\s(?<msg>.+)
| eval user=coalesce(user1,user2)
| stats max(_time) as _time latest(lsg) as msg by user
What this does: extract two field (user1 & user2) from your two sources
coalesce them into one field named "user"
Report the most recent msg for that user and the most recent _time you have an event for
(You should be able to abbreviate this slightly by using the same named field extraction (user) instead of two with a coalesce, I just wanted it to be clear)
from User warren – Stack Overflow https://stackoverflow.com/questions/75386658/splunk-subsearch-is-not-returning-the-data-i-expect-it-to-return/75393485#75393485
via IFTTT