@vumanhtai, multiple ips can be connecting to same port. So ideally you should have the result other way around
<YourBaseSearch> | eval port_status=port." - ".status | stats values(port_status) as port_status by host
...|stats list(port) as port, list(status) as status by host
...|stats values(port) as port, values(status) as status by host
You can try this...
list() does not dedup while values() will dedup