I need to get Windows event details

[rahul_acc_splun]

index="wineventlog" sourcetype="wineventlog:security" | search (action=failure OR action=success) | search (EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4771 OR EventCode=4776) | stats dc(action) as action values(dest) as dest count by user | where action>1
This query is giving me the results for user who has successful success followed by failure but i am not able to check no of failures per destination can you please help me.
I want to have 1 coloum which would have failures number pertaining to user to respective destination.

[niketn]

@rahul_acc_splunk2, first off you need to tweak your search filters for better performance. Move 2nd and 3rd | search pipes to base search. Filtering results upfront in the base search will boost your query performance, otherwise you will carry unwanted events from one command to the next and then eventually filter them out.

index="wineventlog" sourcetype="wineventlog:security" (action=failure OR action=success) (EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4771 OR EventCode=4776) 

After the filter command pipe the following stats command to get Success or Failure group by destinations and users.

| stats count(eval(action="success")) as SuccessCount count(eval(action="failure")) as FailureCount  by user dest
| search FailureCount>1

Only if you want list of all the destinations and just the count of Success vs Failure by user alone, you can use values(dest) and use by user as aggregate:

| stats count(eval(action="success")) as SuccessCount count(eval(action="failure")) as FailureCount  values(dest) as Destinations by user
| search FailureCount>1