@coric  You can try the below thing to handle this. It will give the latest value of Attack_type for given ip_adddress. | stats first(Attack_Type) count as Count by ip_address  If you are using tstats command and Data model, then you can also go for the below thing: | tstats summariseonly=<keep_it_configurable> latest(<data_model>.Attack_type) from datamodel=<> by <data_model>.ip_address  If you find my solution fruitful, then an upvote would be appreciated. ... View more

Perfect, that should work perfectly, il let you know! ... View more