The eventstats command get the dc(dns) and assigns it to the totaldns field on every event. In the original query, you had a stats command to get count. The only field that remain after the stats command are the one's that are included in the stats command. So I added the max(dest_dns), (could have used anything, values, first, last etc.) only so the field carries over and can be used later. In the second query, since you do not have the stats command, you don't need the max piece. So try this index=network sourcetype=nessus severity!=informational signature=*Windows* OR signature=*Adobe* OR signature=*Java* OR signature_family="Windows : Microsoft Bulletins" OR signature_family="Red Hat Local Security Checks" OR signature="Google Chrome*" OR signature="Firefox*" OR signature="MS*" OR signature="Flash Player*" OR signature="Solaris*" | dedup dest_dns signature_id | eventstats dc(dest_dns) as TotalDNS | bin span=1mon _time | eval PatchScore=cvss_base_score/TotalDNS | eval Time=_time | convert timeformat="%m-%Y" ctime(Time) | stats sum(PatchScore) AS "Avg Host Patch Score" by Time ... View more

I was able to rearrange my equation like such with your guidance. index=network sourcetype=nessus severity!=informational signature!=*Windows* signature!=*Adobe* signature!=*Java* signature_family!="Windows : Microsoft Bulletins" signature_family!="Red Hat Local Security Checks" signature!="Google Chrome*" signature!="Firefox*" signature!="MS*" signature!="Flash Player*" signature!="Solaris*" | dedup dest_dns signature_id | bin span=1mon _time | stats count by _time signature_id cvss_base_score | eval scoreadjust=floor(cvss_base_score) | eval scoreadjust=round(pow(scoreadjust,3)/100) | eval riskscore=count*scoreadjust/5500 | eval my_time=_time | convert timeformat="%m-%Y" ctime(my_time) | stats sum(riskscore) as VulnScore by my_time Instead of using the static number of 5500, is there a way I could dynamically count my host scan then use that in an eval statement so stats dc(dest_dns) and then use that instead of the 5500? ... View more