So the query that is currently in use is: index=name source=source_name | fields start_time end_time src subject category id body| dedup id | table start_time end_time src subject category id body Where the table shows all events correlated with the same id, however, it keeps the original start_time and end_time of the first event with that id. I want to keep the original start time, but continuously update the end time. On a side note, when enabling drill down per cell is there a way to have the drill down to the search field only search on the index/source/field selected ? Currently, when clicking on a random field it searches on the index/source/start_time/selected field . ... View more