Hi @AL3Z, your request isn't so cliear: you want all the events from a src_ip to a src_ip, then the list of dest_urls and outbound traffic size, is it correct? you should try something like this: index=your_index sourcetype=your_sourcetype | stats values(dest_url) AS dest_url values(logs) AS logs sum(bytes_in) AS bytes_in sum(bytes_out) AS bytes_out BY src_ip dest_ip | eval traffic_MB_size=(bytes_in+bytes_out)/1024/1024 Ciao. Giuseppe

With this filter i see all combined risk classification per host.  index=test Risk IN (Critical,High,Medium) | timechart span=30 count by extracted_Host I'm now trying to filter and visualize so I can see how often the host has the rating Critical and how often high etc.  and  not like now that i see only the combined value of all risk classification index=test | stats count by extracted_Host, Risk | stats values(Risk) as Risk by extracted_Host | eval has_Critical=mvcount(split(Risk, ",")) > 0 | eval has_High=mvcount(split(Risk, ",")) > 0 | eval has_Medium=mvcount(split(Risk, ",")) > 0 | stats sum(has_Critical) as Critical_Count, sum(has_High) as High_Count, sum(has_Medium) as Medium_Count by extracted_Host but i dont get an output Thanks for the help