This should give you number of weeks (assuming once a week scans) a plugin_name occurs (you can adjust the time period you choose to run this search) your base search | stats count by host-ip plugin_name *OR* your base search | eval wknum=strftime(strptime(host_end, "%a %b %d %H:%M:%S %Y"), "%W") | eval host_plugin="host-ip"."##".plugin_name | chart count over host_plugin by wknum | rex field=host_plugin "(?<host>[^#]+)##(?<plugin_name>.*)" | table host plugin_name * | addtotals | fields - host_plugin ... View more