ryandg, in gathering the information for you request, I identified the source of my issue. The code for the input that was on the 'hosts' page was teh following: <input type="dropdown" token="hostseverity" searchWhenChanged="true"> <label>Severity</label> <choice value="threat>0 AND certainty>0">All</choice> <choice value="threat>=50 certainty>=50">Critical</choice> <choice value="threat>=50 certainty<=50">High</choice> <choice value="threat<=50 certainty>=50">Medium</choice> <choice value="threat>0 AND threat<50 certainty>0 AND certainty<50">Low</choice> <initialValue>threat>0 AND certainty>0</initialValue> </input> In the drilldown, I actually provided the named and not the value. So by changing hosts?form.hostseverity=High to: hosts?form.hostseverity=threat%3E%3D50%20certainty%3C%3D50 I solved my problem. Thanks for your help. ... View more

Rich, here are a couple of event: Mar 4 06:00:50 192.168.15.125 Mar 4 06:00:01 S14945214214616 - -: CEF:0|Vectra Networks|Vectra|2.3|hsc|Host Score Change|3|externalId=5084 cat=HOST SCORING shost=BThomas-Win7 src=192.168.111.3 dst=192.168.111.3 flexNumber1=84 flexNumber1Label=risk cs4=https://192.168.15.125/hosts/5084 cs4Label=URL start=1457100001073 end=1457100001073 Mar 4 03:00:50 192.168.15.125 Mar 4 03:00:01 S14945214214616 - -: CEF:0|Vectra Networks|Vectra|2.3|hsc|Host Score Change|3|externalId=5086 cat=HOST SCORING shost=WSmith_WinPC src=192.168.111.2 dst=192.168.111.2 flexNumber1=64 flexNumber1Label=risk cs4=https://192.168.15.125/hosts/5086 cs4Label=URL start=1457089201104 end=1457089201104 ... View more

Actually, I think I over simplified my question which is why I am having such a hard time getting my arms around this problem. In my case, the "event type" is actually a state that can change at any given time. (i.e. machine x changed from state 'a' to state 'b') So I just realized that part of my problem is that I am deduping which eliminates all events except for the final state change. This in combination of the idea that I am not keeping a running tally for each day, I don't see an easy way to track trends. In the end, what I was hoping to accomplish was show trends in change in state over a period of time. I just need to rethink this a little. Thanks for the response. Greatly appreciated. ... View more