Apologies for the lack of answers etiquette 😀. join ended up working for me:   index=firewalls sourcetype=pan:traffic dest_zone=untrust dest_port=443 | join dest [ search index=firewalls sourcetype=pan:threat dest_zone=untrust dest_port=443] | stats sum(bytes) as total_bytes by dest_hostname     ... View more

I have this use case and want to report on bytes by dest_hostname. After adjusting for current Palo field names, the provided answer yields no results: index=firewalls sourcetype=pan:traffic dest_zone=untrust dest_port=443 [search index=firewalls sourcetype=pan:threat | fields dest_hostname] | stats sum(bytes) BY dest_hostname   ... View more