I am trying to identify the unique number of hosts reporting from a source. When the source is indexed, the host field sometimes is FQDN and sometimes is IP address. They are not duplicate entries, just different data/logs. I have two separate searches, one that ignores the IP address hosts and delivers unique hosts as FQDN: source="logsource" | search host!="10.xxx" | dedup host | stats count by host And one that uses the rex (I'm new to using this) option to pull the FQDN elsewhere in the log: source="logsource" | search host="10.xxx" | rex field=_raw "leadingText, (newhostfield.) trailingText" | dedup newhostfield | stats count by newhostfield, host I want to combine the two lists in a search and dedup to give me a unique list of hosts from this log source. Anyone able to point me in the right direction? Thanks ... View more