Hi @curtgran, as @fk319 said, you could use the transaction command, but this is a very slow command, so I hint to use it only if you haven't any other solution. I usually use stats command correlating events by the common key (in your sample AssignedIP and src_ip). Something like this: (search_one) OR (search_two) | rename src_ip AS AssignedIP | stats values(username) AS username earliest(_time) AS _time values(dest_ip) AS dest_ip values(traffic) AS traffic BY AssignedIP I listed all the fields you have, obviously you can use only the ones you need in your use cases. ciao. Giuseppe ... View more

I might try something with stats, e.g. <search> ... | stats list(port) as portlist by ip | table ip, portlist ... View more