@shahidkhan545 You need to explain the problem. For starters, some sample data (anonymized) would help. How do 'success' and 'failure' and 'appid' appear in the logs/events? Are they in fields that are already extracted? Suppose your event already comes with a field 'status' which can be 'success' or 'failure', and a field 'appid', you can count by something like
source = mysource
| stats count by appid status
Why do you need a CSV file? (In other words, what is the structure and sample data in your CSV?)