here is the start of my search but having issues figuring out the best way to capture the information i need.
| tstats summariesonly=true values(All_Changes.result) as description from
datamodel=Change_Analysis where index=wineventlog All_Changes.tag=
audit
All_Changes.tag!=stopped by All_Changes.src, All_Changes.result_id, All_Changes.change_type,
All_Changes.action, All_Changes.status | rename All_Changes.* as *
