How to count valuse and display againts another field?

[Matrix20085]

Sorry, I am unsure how to describe what I am looking for using Splunk terminology, and I am sure that is why I am having trouble finding the answer.

What I am looking for:

User    |  Status   | coun
---------------------------------
Mike   |   True       |    2
            |   False      |    1
--------------------------------
Loagn |  True      |    4
             |   False    |    2

So far my search looks like this:

index=logs EventType="logon"
| stats values(Status) as Status count by User

It is almost there, but in the count column, it combines the count for True and False and only gives a single number.

[ITWhisperer]

index=logs EventType="logon"
| stats count by User Status

[Matrix20085]

This is where I started, but it lists the User for each Status they have. I was hoping to have the user listed once with all of their different statues next to them.

[ITWhisperer · Accepted solution]

Each row is an event with various fields - if you want to combine the results events by User, try something like this:

index=logs EventType="logon"
| stats count by User Status
| stats list(Status) as Status list(count) as count by User

[Matrix20085]

Nailed it! Thanks so much.