How to group values

[becksyboy]

Hi

I have a field name called report_name, it can have a number of status values associated with it, i.e. status=a or status=b or status=c etc.

A complete report run would have (status = a & status = b)

A failed report run would have (status = a & status = b & status = c)

How do I group results where (status = a & status = b) = Good  and (status = a & status = b & status = c) = Failed for a particular report name?

The issue I'm running into is when a report_name has both (status = a & status = b) &  a little while later (status = a & status = b & status = c) I am unable to group them correctly, and end up naming both the same. 

thanks

[somesoni2]

What is the frequency of the report? For your report's timerange, does the the report run once OR multiple times? Is there any other field using which  you can uniquely identify a report's execution? If you have a key field OR set of key fields, you'd be able to use `| stats list(status) as statuses ... by key_fields` to get list of status return and then categorize them by that.

[becksyboy]

Thanks for the suggestions, I will investigate to see if there is a unique field.