Thanks for the replies but I think my explanation was not sufficient sorry about that. Basically, my query will look like something this: host=ciscoasafw index=firewall This will list thousands of IP addresses and ports. I want to make sure if a there are 2 events within 5 seconds where source IP is 1.1.1.1 and source port is 11 and destination ip is 2.2.2.2 destination port 22 AND its reverse where source IP 2.2.2.2 source port 22 and destination ip 1.1.1.1 destination port 11 is happening then the result happening later is discarded - example: 14:22:50 ciscoasafw : %ASA-6-106100: access-list ACL_INSIDE permitted tcp INSIDE/1.1.1.1(11) -> OUTSIDE/2.2.2.2(22) hit-cnt 2 300-second interval [0xb4d91445, 0x0] 14:22:48 ciscoasafw : %ASA-6-106100: access-list ACL_OUTSIDE permitted tcp OUTSIDE/2.2.2.2(22) -> INSIDE/1.1.1.1(11) hit-cnt 5 300-second interval [0x6450c313, 0x0] In this example the result with 14:22:50 should be discarded. I don't want to match on IP but only match on a statement like "if a result X Y IP and port AND its reversed Y X IP and port" happened within 5 seconds I should only see the one which happened first. Hope I didn't confuse anyone : -) ... View more