Dear Community, So far, I have gone through the posted QnAs, but haven't yet found a way to make it work with my data context and desired output. I'm analyzing ASA firewall logs. I'm trying to make a search for the top 30 inbound ports for a range of IPs. FIELDS: Destination IP = dest_ip Destination Port = dest_port Protocol = protocol The closest I could get was as below; dest_ip="10.66.100.*" | stats value(dest_port) count by dest_ip The above gave me a list of IPs and ports but the total count was seemingly for all ports combined. DESIRED OUTPUT: IP # List of Ports # Hits count for each port # Protocol # Percentage of total traffic Search results for ports belonging to the same IP address should be grouped together. So IP address followed but multi-value field of ports with corresponding count, protocol and percentage for each. We can also try this on the buttercupgames data so that we all get same output format; Fields for buttercupgames: dest_port = clientip dest_ip= productId Let's use just these two fields above, forget protocol & port. Buttercupgames | stats count by productId,clientip | eventstats sum(count) as total by productId | eval percentage=round((count/total)*100,2) | stats list(*) as * by productId | sort -total | head 30 | fields - total I hope you already have buttercupgames data or know how to get it. I'm not allowed to post links yet. It's Splunk's own sample data. Regards! ... View more