Here's what we are trying to do with our Juniper Netscreen Firewall data for outbound denied traffic: Find the top 3 Protocol and Dst_Port combination where Action="pckt dropped" (using summarized data) For each combination, get the top hosts Sort the hosts by event count We can get as far as #2 using subsearch, eval and the stats values function: index=summary search_name="MySummarySearch" [search index=summary search_name="MySummarySearch" | top Dst_Port by Protocol | sort - count | head 3 | fields + Dst_Port,Protocol] | eval foo=Protocol+" - "+Dst_Port | top foo by Src_Addr | eval bar="("+count+") "+Src_Addr | stats values(bar) as Hosts sum(count) as Total by foo | rename foo as "Protocol & Dest Port" | sort - Total The output looks something like this: Protocol & Dest Port Hosts Total -------------------- ------------------- ----- tcp - 80 (1) 10.15.12.111 54 (1) 10.15.125.111 (1) 10.2.64.111 (1) 10.2.64.222 (10) 10.15.171.111 (13) 10.15.171.222 (18) 10.5.40.111 (2) 10.15.124.111 (2) 10.20.176.111 (2) 10.9.72.111 (3) 10.20.8.111 -------------------- ------------------- ----- udp - 53 (17) 10.5.4.111 41 (5) 10.15.12.111 (5) 10.5.4.111 (7) 10.15.12.111 (7) 10.15.12.111 -------------------- ------------------- ----- tcp - 443 (14) 10.15.1.111 29 (15) 10.15.1.222 How to get the Hosts column to sort by the numerical event count shown above in parens? We like the grouping provided by the stats values() function, but it sorts lexigraphically. 😞 ... View more