Good day everyone, Ran into following problem, The query index=source | eval time=strftime(_time, "%+) |stats max(time) values(from) as Sender, values(rcpt) as Recipients, value(subject) as Subject values(hops_ip) as SenderIP values (ref) as Reference by ref |where like(senderIP, "10.%)   Not sure where went wrong, senderIP which is not 10.% is still showing. I did noticed that the ref value appears multiple times for different transaction, that could be the cause? Happy new year in advance! ... View more