use the | dedup before the | table pipe, it should work more like below Latency_-Session_Average > 50 | search host=servername | sort -size -Latency-Session_Average |dedup USERNAME |table UserName, host, Latency-_Session_Average, RACF_ID, Event_Date, Event_Time, ICA_Name ... View more