I have search like below to show me 'src_ip' and 'count' every last 10 min index="pan" sourcetype="pan:threat" earliest=-10m action=allowed NOT [| inputlookup Exclusions | fields src_ip] | stats count by src_ip| where count > 10 | sort - count 1.1.1.1 10 2.2.2.2 12 and second search to show only src_ip in last 24h (to eliminate src_ip repeated in any of 10 min periods for last 24h) index="pan" sourcetype="pan:threat" earliest =-24h action=allowed NOT [| inputlookup Exclusions ] | bin _time span=10m | stats count by _time src_ip | where count > 10 | stats count by src_ip | where count = 1 | fields - count but combined search to show my only src_ip with count where src_ip is present in subsearch is not working correctly .. because src_ip values are not unique in subsequent 10 min interval index="pan" sourcetype="pan:threat" earliest=-10m action=allowed NOT [| inputlookup Exclusions | fields src_ip] | stats count by src_ip| where count > 10 | sort - count IN [index="pan" sourcetype="pan:threat" earliest =-24h action=allowed NOT [| inputlookup Exclusions ] | bin _time span=10m | stats count by _time src_ip | where count > 10 | stats count by src_ip | where count = 1 | fields - count]       ... View more