Hi
I have a field name called report_name, it can have a number of status values associated with it, i.e. status=a or status=b or status=c etc.
What is the frequency of the report? For your report's timerange, does the the report run once OR multiple times? Is there any other field using which you can uniquely identify a report's execution? If you have a key field OR set of key fields, you'd be able to use `| stats list(status) as statuses ... by key_fields` to get list of status return and then categorize them by that.
Thanks for the suggestions, I will investigate to see if there is a unique field.