sort is the correct answer as mentioned by others but since expected output has IPs as well as Values sorted in it hence it actually should be: yourBaseSearch | sort by IP, Value OR without by yourBaseSearch | sort IP, Value ... View more

Consider this: | stats count | eval foo = "A-1.1,A-0.3,A-1.9,A-1.2,A-0.9,B-0.9,B-0.9,B-1.1,B-1.6" | makemv foo delim="," | mvexpand foo | eval Name = replace(foo, "-.*", "") | eval Value = tonumber(replace(foo, ".*-", "")) | fields - count foo | eval temp = if(0.7 < Value AND Value < 1.3, 0, 1) | delta temp as delta | eval temp = if(delta == -1, 1, temp) | streamstats sum(temp) as Id by Name | fields - temp delta ... View more