index=main sourcetype=* | lookup ips AS ips OUTPUT ips1 ips2 | mvexpand ips1 ips2 | stats values(_raw) count DC(ips) AS dc by ips1,ips2 | where dc==1 I can't test it since you don't have logs. ... View more

Maybe (not sure about how you are doing sourcetype ) like this: index=YouShouldAlwaysSpecifyAnIndex sourcetype="conn_log" [search index=YouShouldAlwaysSpecifyAnIndex sourcetype="conn_log" | Top 5 Orig_IP | table Orig_IP] | timechart span=1h count BY sourcetype Also, look at the new Trellis feature: https://discoveredintelligence.ca/splunk-6-6-new-features-part-iv-trellis/ ... View more