Although the question is 4 years old I had encountered something similar for an Alert. Please try this | makeresults count=10 | streamstats count as temp | eval temp1=abs(10-temp) | eval ip1="10.10."+temp+"."+temp1 | eval ip2="10.10.7.".temp | stats values(ip1) as ip1, values(ip2) as ip2 | mvexpand ip1 | mvexpand ip2 | where ip1 = ip2 ... View more