How to combine like events based off hostname?

[atebysandwich]

I have events that where hostnames  show up more than once and I would like to combine them. The fields available are DNS Host_Auth IP. There will be vents where the =DNS is the same but the Host_Auth will be null and the IPs will be different. How can I combine by DNS to show the Host_Auth value that is not null and shows by IPs of the combined DNS? 

[richgalloway]

It's not clear what the desired results are, but perhaps you could use the stats command to collect events by common DNS values.

| stats values(*) as * by DNS