Hi I have to creat a total_threat_score field which will be the total of all other score fields like if action==allowed it should add a new field called score and add 1 to it...then if bytes_in>100000 then add +1 to that score field.. index=* sourcetype=netscreen:firewall | eval score1=1 | where byte_in>10000| eval score2=score1+1 | where bytes_out>1000 | eval score3=score2+1 | where action="allowed" this query is not putting results for action=allowed is this the right way to do? please help ... View more