There are two techniques that you can use to track system state: the dedup command and lookup tables. To use the dedup command, assume that your data here has three fields: from, to, state. Your search would look like: ... | dedup from to The result set would be the most recent message for a given (from, to) pair and would represent the current system state. In the worst case, however, this search would have to run over ALL data to assemble the system state. The way to speed this up is to periodically, using a saved search, persist the current state, as well as the timestamp of the last change, into a lookup table (using outputlookup ). When retrieving the current state, use the dedup approach over a recent window of data, append the full lookup table and use stats to pick the newest version of every state variable. This is the same recipe for persisting the state back to the lookup table. ... View more