Please try:
Log Type: intrusion prevention
select attack, vuln_type, srcip, dstip, min($calendar_time) as first_seen, max($calendar_time) as last_seen, count(*) as totalnum, t1.severity from $log t1 left join ips_mdata t2 on t1.attack=t2.name where $filter and vuln_type is not null group by attack,vuln_type,srcip, dstip, t1.severity order by totalnum desc
hz
