I have a common field name for different sources. How do I view results from one source for this particular field name?

I have common signature fields for both devices (Palo Alto and McAfee IPS) in the results. I just want to see the results from McAfee IPS signature filed. Please advise.