https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667526#M228998 <P>Each row is an event with various fields - if you want to combine the results events by User, try something like this:</P><LI-CODE lang="markup">index=logs EventType="logon" | stats count by User Status | stats list(Status) as Status list(count) as count by User</LI-CODE> Mon, 06 Nov 2023 13:31:05 GMT ITWhisperer 2023-11-06T13:31:05Z https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667518#M228992 <P>Sorry, I am unsure how to describe what I am looking for using Splunk terminology, and I am sure that is why I am having trouble finding the answer.<BR /><BR />What I am looking for:<BR /><BR />User&nbsp;&nbsp;&nbsp; |&nbsp; Status&nbsp;&nbsp; | coun<BR />---------------------------------<BR />Mike&nbsp;&nbsp; |&nbsp;&nbsp; True&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp; 2<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp; False&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp; 1<BR />--------------------------------<BR />Loagn |&nbsp; True&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp;&nbsp; 4<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |&nbsp;&nbsp; False&nbsp;&nbsp;&nbsp; | &nbsp;&nbsp; 2</P> <P>&nbsp;</P> <P>So far my search looks like this:</P> <LI-CODE lang="markup">index=logs EventType="logon" | stats values(Status) as Status count by User</LI-CODE> <P><BR /><BR />It is almost there, but in the count column, it combines the count for True and False and only gives a single number.</P> Mon, 06 Nov 2023 13:08:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667518#M228992 Matrix20085 2023-11-06T13:08:43Z https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667519#M228993 <LI-CODE lang="markup">index=logs EventType="logon" | stats count by User Status</LI-CODE> Mon, 06 Nov 2023 13:13:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667519#M228993 ITWhisperer 2023-11-06T13:13:20Z https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667523#M228996 <P>This is where I started, but it lists the User for each Status they have. I was hoping to have the user listed once with all of their different statues next to them.</P> Mon, 06 Nov 2023 13:23:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667523#M228996 Matrix20085 2023-11-06T13:23:15Z https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667526#M228998 <P>Each row is an event with various fields - if you want to combine the results events by User, try something like this:</P><LI-CODE lang="markup">index=logs EventType="logon" | stats count by User Status | stats list(Status) as Status list(count) as count by User</LI-CODE> Mon, 06 Nov 2023 13:31:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667526#M228998 ITWhisperer 2023-11-06T13:31:05Z https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667530#M229000 <P>Nailed it! Thanks so much.</P> Mon, 06 Nov 2023 13:44:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-valuse-and-display-againts-another-field/m-p/667530#M229000 Matrix20085 2023-11-06T13:44:35Z