Based on the Cisco ASA TA, and eventgen, you could start here as a base: index=test sourcetype="cisco:asa" ( action=blocked OR action=allowed ) | transaction dest maxspan=10 startswith="action=allowed" endswith="action=blocked" | stats count by dest | where count > 50 A few things to note, you want to reverse dest to src and the startswith and endswith. (I was limited by what eventgen is generating.) And of course update your index and sourcetypes... It's also worth noting that firewall logs are generally extremely high velocity. Meaning, that these usually are millions of events per minute. This means transaction over 10 minutes is extremely inefficient and will take a long time. There are probably better approaches to this, such as doing a reducing search with stats, and dumping that to a summary index, and then run the transaction against that summarized data. ... View more