My log entries look like this: DATE: order=8 status=processed -many entries in between- DATE: order=8 status=completed Is there some way I can get a count of instances where "order=X processed" is found but where "order=X completed" is not found? I'm pretty new to splunk queries, and have been reading up, but this is kind of specific and I'm not even sure if it's possible, so I thought I would ask. Also, I can control the log files, so if there is a different way of separating fields or a way of logging that would make this easier, please let me know. ... View more