I had a similar use case to this, however I wanted to only use one field for both the client IP address and resolved hostname. I used eval with if and isnull to substitute the null values with the original client IP address value so that it's retained. Using fillnull as is commonly suggested would only substitute the null values with a predefined string. `some kind of search` | lookup dnslookup clientip as c_ip output clienthost as host_resolved | eval hostname = if(isnull(host_resolved), host, host_resolved) | stats count by hostname, user ... View more