Smart Event - Top Resource

[Avivanco]

Hello, 

I'm trying to get a table with the "Resource" that have been seen the most in a day.

In my table, I see that the logs are counted from "Malware Action" and not by "Resource". I've tried setting the log count to go according to "Resource", but then the search fails.

Is there any chance of getting the table?

Thank you.

[PhoneBoy]

I believe the Resource field is not indexed thus cannot be used in reports.