@richgalloway I tried to send this yesterday, but it seems to have been lost in the ether. The |stats command you gave me didn't output anything in the statistics view. I figured out the problem and solved it with the | dedup command you can see in the complete search below. I added a few fields for the table as well, for tracking. Thank you for your help. Not sure I would have found the solution without your help. index="wineventlog" host="mgmt" source="wineventlog:application" "EventCode=999" "SourceName=NetworkLatencyCheck"
| sort 1 - _time
| mvexpand SubnetSourceLatencyDestinationSiteLocationStatus
| rex Field=SubnetSourceLatencyDestinationSiteLocationStatus "^(?<Subnet>.*),\$(?<Source>.*),\$(?<Latency>.*),\$(?<Destination>.*),\$(?<Site>.*),\$(?<Location>.*),\$(?<Status>.*)"
| regex Source="(\d{1,3}\.(\d{1,3}\.(\d{1,3}\.(\d{1,3})"
| stats min(Latency) as latency by Subnet, Destination, Location, _time
| dedup Subnet sortby +Latency
| sort Subnet
| table Subnet Latency Destination Location _time
... View more