Hi I have a question to how I do a report based on multiple events. In this particular case, I started logging from our Cisco Wireless Lan Controller. I receive multiple AP association and disassociation events. I can easily query to find the disassociation events and I can also easily query for association events. But I'm having a problem how to form a query to combine the events. I want 2 different reports. 1) Get a list of access points that sent a disassociation event but no association events after that. (disappeared from the network) 2) Get a list of access points that sent an association event with no disassociation event before that (say within the last 24 hours) - (New access points added to the network) Example to query for an disassociation event: index=wireless bsnAPDisassociated | rex "bsnAPName.0 = STRING: \"(?<apname>\S+)\"" Example to query for an association event: index=wireless ciscoLwappApMIBNotifs.4 | rex "cLApName.'\S+' = STRING: (?<apname>\S+)" I will appreciate any hints I can get to solve my problem. ... View more