Hi @dmarling Thanks for replying the below query which you shared it not working exactly. I would like to give some inputs, This is query with join: " index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=309425 | fields deviceId ] | fields deviceName, physicalElementId, hwEoxId | dedup physicalElementId | table deviceName, physicalElementId, hwEoxId | stats count as Devices by hwEoxId | stats sum(Devices) as Devices" sample ouput of the 1stquery " index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId" cpyKey: 168347 currentEoxMilestone: LDoS currentEoxMilestoneDate: 2018-01-31T00:00:00 deviceId: 18468220 deviceName: 10.24.13.240 hwEoxId: 286609 nextEoxMilestone: null nextEoxMilestoneDate: null physicalElementId: 362026445 physicalType: Power Supply productId: C3K-PWR-265WAC timeStamp: 2020-12-15T12:57:03 Output of second query"index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=309425 | fields deviceId" "deviceId:16642716 groupId:309425 groupName:Cisco 3900 ISR Routers timeStamp:2020-12-15T12:56:41" Output of the query till dedup of physicalElementId "index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681 | fields deviceId ] | fields deviceName, physicalElementId, hwEoxId | dedup physicalElementId" '' ''cpyKey: 168347 currentEoxMilestone:LDoS currentEoxMilestoneDate:2018-03-31T00:00:00 deviceId:15459204 deviceName:10.82.112.71 hwEoxId:266079 nextEoxMilestone:null nextEoxMilestoneDate:null physicalElementId:341757347 physicalType:Module productId:SFP-GE-L timeStamp:2020-12-15T12:57:02"" Also I have attached the table values as pdf for ""| table deviceName, physicalElementId, hwEoxId"" Please help me in removing the join in the query at the top. Thanks a lot
... View more