Give this a try
index="79390-np" sourcetype=np-cache-v2 (physicalType="MODULE" currentEoxMilestone="SALE_DATE" source="hw*eox.") OR (source="group_member" groupId="185524" ) OR (source="device_details" productFamily!=null) | eval source=if(match(source,"hw.*eox\."),"hweox",source)
| table deviceId source productId deviceName deviceIp swVersion configTime inventoryTime
| stats count values(*) as * by deviceId | where mvcount(source)=3
| stats sum(count) AS Total by deviceName, productId, deviceIp, swVersion, configTime, inventoryTime
| eval configTime=strftime(strptime(configTime,"%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d")
| eval inventoryTime=strftime(strptime(inventoryTime,"%Y-%m-%dT%H:%M:%S"),"%Y-%m-%d")
| rename deviceName as Device, Total as Count, productId as "Product ID", deviceIp as "IP Address", swVersion as Version, configTime as "Config Collected", inventoryTime as "SNMP Collected"
| table Device, "Product ID", Count, "IP Address", Version, "Config Collected", "SNMP Collected"
... View more