Here is a start - what time range do you intend to search? index=wireless bsnAPDisassociated OR ciscoLwappApMIBNotifs.4 | eval eventCategory=if(match(_raw,"ciscoLwappApMIBNotifs.4"),"Disassociated","Associated") | rex "bsnAPName.0 = STRING: \"(?<apname1>\S+)\"" | rex "cLApName.'\S+' = STRING: (?<apname2>\S+)" | eval apname = if(eventCategory=="Associated",apname2,apname1) | eval timeAssoc =if(eventCategory=="Associated", _time,null()) | eval timeDisassoc =if(eventCategory=="Disassociated", _time,null()) | stats earliest(timeAssoc) as earliestTimeAssoc latest(timeAssoc) as latestTimeAssoc count(eval(eventCategory="Associated")) as AssocCount earliest(timeDisassoc) as earliestTimeDisassoc latest(timeDisassoc) as latestTimeDisassoc count(eval(eventCategory="Disassociated")) as DisassocCount by apname ... View more