Assuming you are using the directives in the default sourcetype of access_combined_wcookie and your ip address field is called clientip... you want this: index=whatever sourcetype=whatever |top clientip|fields - percent the "top" command will give you a percent column as well as a count column so you can remove it with 'fields'. you can adjust how many ip addresses show by adding limit= |top limit=20 clientip If you want all your ip addresses you could just say |stats count by clientip|sort -count You might want to take a look at this book available on Amazon (kindle version is $18.00) which will take you through a nice slow lesson on how to use the search language. ... View more