Try this: sourcetype="cisco:asa" host="*" message_id=113039 OR message_id=716002 OR message_id=113019 | eval ClientIP=src_ip | rex "IP \<(?<new_ip>111.222.333.444)\>" | eval ClientIP = coalesce(ClientIP,src_ip,IP,new_ip) | stats first(host) as host, first(bytes_in) as bytes_in, first(bytes_out) as bytes_out, first(Total-BW) as Total-BW, first(duration_hour) as duration_hour, first(duration_minute) as duration_minute, first(duration_second) as duration_second, first(_time) as event_time by ClientIP user messageID | localop | iplocation ClientIP | rename bytes_in as Byte_Rcv | rename bytes_out as Byte_xmt | eval event_time=strftime(event_time,"%x %X") | addtotals fieldname=Total-BW Byte The stats command picks the first non-null value for each field. If there is more than one value and you want to see them all, use "list" instead of "first" in the stats command. ... View more