Thank you everyone for your answers and it was very helpful.  I have modified query  as per my requirement. However i have couple of queries. 1. what if difference between value and list fields.  2. Is it possible that i can contain these chain of events between two hosts only. 3. By using below query i am getting output as table. however is it possible that i can relate host column values with eventcodes columns values like which events in eventcodes column is bind with host value in host column. you can see table in attachment.  index=windows host=* (EventCode=4648 OR EventCode=4672 OR (EventCode=4624 AND Logon_Type=3)) Account_Name!=*$ | fields _time EventCode host Account_Name Logon_Type | streamstats time_window=120s values(EventCode) AS eventcodes dc(EventCode) AS eventcode_counts values(host) as hosts values(_raw) as raw values(Account_Name) as users values(Logon_Type) as logontype | where eventcode_counts=3 | table _time hosts eventcodes eventcode_counts users logontype ... View more

Thank you..  ... View more