Try this instead of using
your base search | eventstats values(dn) as dn by conn | where tag=101 | timechart count by dn usenull=f useother=f
Thnx for the reply. Sorry but it says "No results". If i don't use transaction then the events are not grouped based on conn number. The DN value is only present after the binding is complete so I used transaction so that the dn and SRCH are grouped in same event.