sourcetype="cisco:asa" host="*" message_id=113039 OR message_id=716002 OR message_id=113019
| eval ClientIP=src_ip | rex "IP \<(?<new_ip>111.222.333.444)\>"
| eval ClientIP = coalesce(ClientIP,src_ip,IP,new_ip)
| stats first(host) as host, first(bytes_in) as bytes_in, first(bytes_out) as bytes_out,
first(Total-BW) as Total-BW, first(duration_hour) as duration_hour,
first(duration_minute) as duration_minute, first(duration_second) as duration_second,
first(_time) as event_time by ClientIP user messageID
| localop | iplocation ClientIP
| rename bytes_in as Byte_Rcv | rename bytes_out as Byte_xmt
| eval event_time=strftime(event_time,"%x %X")
| addtotals fieldname=Total-BW Byte
The stats command picks the first non-null value for each field. If there is more than one value and you want to see them all, use "list" instead of "first" in the stats command.