Search Help combine with Dashboard

[coric]

Here's my challenge,

I've got multiple same IP with Different Attack_type categories,

I'm trying to combine all the same IP  together and make a chart that shows the Attack_type and just 1 IP

Something like this but a dashboard that list out what IP is associated to all the different Attack_type 

[jhanvidattani]

@coric 

You can try the below thing to handle this. It will give the latest value of Attack_type for given ip_adddress.

| stats first(Attack_Type) count as Count by ip_address

 If you are using tstats command and Data model, then you can also go for the below thing:

| tstats summariseonly=<keep_it_configurable> latest(<data_model>.Attack_type) from datamodel=<> by <data_model>.ip_address

 If you find my solution fruitful, then an upvote would be appreciated.