Hi @avivn, You can add the same threat intel source twice by selecting different field as var.   ... View more

| makeresults count=10 | streamstats count as temp | eval temp1=abs(10-temp) | eval ip1="10.10."+temp+"."+temp1 | eval ip2="10.10.7.".temp | eventstats values(ip2) as tmp | stats count(eval(match(tmp,ip1))) as count list(ip2) as ip2 values(temp) as temp by ip1 | sort temp | fields - temp @sidbisht  your creating temp1 is interesting.   How about this query? For comparing fields, make multi value and use match(), I think. ... View more

thank you it works ! ... View more

Anytime 🙂 ... View more

This puts your data in, as you have presented it... | makeresults | eval _raw=" 1 2 3 4 5 6 7 8 9 10 0 0 0 0 0 0 0 0 0 0 502 497 496 496 497 500 499 499 498 497 0 0 0 0 0 0 0 0 0 0 496 491 493 492 493 497 496 497 497 492 496 488 492 491 490 496 495 497 496 491 506 502 502 501 504 506 504 504 503 501 496 490 490 490 491 495 493 494 494 491 549 541 542 541 542 547 547 548 547 542" This turns it into data fields called Tester_01 thru Tester_10, then assigns one-second increments to the different readings. The actual _time used is completely arbitrary in this version. | multikv noheader=true | rename Column_* as Tester_0* | rename Tester_010 as Tester_10 | streamstats count | eval _time = _time + count | table _time Tester* Now we turn it into one result record per tester per _time unit, and then timechart the results... | Untable _time tester result | timechart span=1s sum(result) by tester Your data basically all land on top of one another, so there's not a lot to see in the result graph, but it works. ... View more

Try this base search returning single value | append [| makeresults | eval samefieldasreturnedbybasesearch=0] | head 1 ... View more

Hey, Ended up using dedup file_id instead of using transaction like @acharlieh suggested and it works great ! Thank you both for your help. ... View more