Try this
index=* tag=network NOT ((src_ip=10.100.90.34 AND dest_ip=10.100.1.1) OR (src_ip=10.100.90.34 AND dest_ip=10.100.1.2) )(dest_port=25 OR dest_port=465 OR dest_port=2525 OR dest_port=110 OR dest_port=995 OR dest_port=143 OR dest_port=993) NOT
[
| inputlookup Inventory
| eval category=split(asset_category, "|")
| search category="Email" OR category="Mail"
| return 100 $asset_ip ]
| eval is_local=`local_ip_list(src)`
| where is_local=1
| stats earliest(_time) as Timestamp, values(dest) as "Destination IP", values(app) as Application, values(dest_port) as Port, values(user) as Username, earliest(_raw) as "Raw Log", count by src
| convert ctime(Timestamp)
| rename count as Correlated src as "Source IP"
| search Correlated >29
... View more