If I run the below search the statistics output changes while the search is progressing and when the search is completed not all results that was seen during the search is visible.  | tstats summariesonly=f count from datamodel=Network_Traffic by All_Traffic.app,All_Traffic.src,All_Traffic.dest,All_Traffic.dest_port,All_Traffic.action | lookup xxxx CIDR AS All_Traffic.src OUTPUT CIDR as cidr_ip2 fullzonename as sourcenetwork ZoneType as sourcezonetype | lookup xxxx CIDR AS All_Traffic.dest OUTPUT fullzonename as destinationnetwork ZoneType as destinationzonetype | where (cidrmatch(cidr_ip2,'All_Traffic.src')) | search sourcezonetype="yyyy" AND destinationzonetype!="*zzzz" | stats count by sourcenetwork sourcezonetype destinationnetwork destinationzonetype All_Traffic.action ... View more