https://community.splunk.com/t5/Splunk-Search/How-to-correlate-across-events-then-aggregate-by-a-different/m-p/462054#M191441 <P>Try this:</P> <PRE><CODE>| stats values(user) as user, values(result) as result by traceid | stats count(result="200") as "success", count(result!="200") as "failure" by user </CODE></PRE> Mon, 26 Aug 2019 21:58:35 GMT masonmorales 2019-08-26T21:58:35Z https://community.splunk.com/t5/Splunk-Search/How-to-correlate-across-events-then-aggregate-by-a-different/m-p/462053#M191440 <P>Something like,</P> <P><STRONG>DEBUG traceid=123 user=john<BR /> DEBUG traceid=123 result=200<BR /> DEBUG traceid=456 user=john<BR /> DEBUG traceid=456 result=400<BR /> DEBUG traceid=789 user=sue<BR /> DEBUG traceid=789 result=200<BR /> DEBUG traceid=abc user=john<BR /> DEBUG traceid=abc result=200</STRONG></P> <P>I want to get:<BR /> <STRONG>John success 2 failure 1<BR /> sue success 1 failure 0</STRONG></P> Mon, 26 Aug 2019 19:46:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-correlate-across-events-then-aggregate-by-a-different/m-p/462053#M191440 toehser1 2019-08-26T19:46:24Z https://community.splunk.com/t5/Splunk-Search/How-to-correlate-across-events-then-aggregate-by-a-different/m-p/462054#M191441 <P>Try this:</P> <PRE><CODE>| stats values(user) as user, values(result) as result by traceid | stats count(result="200") as "success", count(result!="200") as "failure" by user </CODE></PRE> Mon, 26 Aug 2019 21:58:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-correlate-across-events-then-aggregate-by-a-different/m-p/462054#M191441 masonmorales 2019-08-26T21:58:35Z