A network switch for implementing a Software Defined Network can include one or more memory resources storing a flow table and including a buffer. The network switch can receive and analyze data packets to generate a lookup key for each respective data packet. Using the lookup key, the network switch can perform a lookup in the flow table to determine a rule number for the respective data packet. Based on the rule number, the network switch can generate an event record for the respective data packet, and store the event record in a block of the buffer. When the block is full, the network switch can stream a set of event records from the buffer to a processing resource to enable the processing resource to update counter tables, external to the network switch, to implement the Software Defined Network.