Hi @zeeshantayyab, you could add also the destination_ip to the search using values: index="firewall" | stats dc(destination_port) as pcount values(destination_ip) AS destination_ip values(destination_port) AS destination_port by source_ip | where pcount > 500 but in this way you have a few readable dashboard, my hint is to create a simple main search index="firewall" | stats dc(destination_port) as pcount by source_ip | where pcount > 500 then you can configure a drilldown in another panel of the same dashboard or in another dashboard where there's the details of your connections: index="firewall" source_ip=$source_ip$ | stats values(destination_port) AS destination_port by destination_ip if you need help in drilldown configuration you can see in the Splunk Dashboard Examples app (https://splunkbase.splunk.com/app/1603/) how to do this. Ciao. Giuseppe ... View more

Hi, Why this query is not working in my environment. ... View more