Take what was given previously and adjust with your additional fields you need carried through. Original Suggestion | stats values(Sockets) as Sockets by IP Hostname ID
| eval Sockets=mvjoin(Socket...
See more...
Take what was given previously and adjust with your additional fields you need carried through. Original Suggestion | stats values(Sockets) as Sockets by IP Hostname ID
| eval Sockets=mvjoin(Sockets, ",") Extended Suggestion | stats values(x) as x, values(y) as y, values(Sockets) as Sockets by IP Hostname ID
| eval Sockets=mvjoin(Sockets, ",")
| table IP Hostname ID Sockets x y Extend as many fields that you want to carry forward and the table is only required if you wish to control the display order of the fields, completely skip otherwise.