Hi Splunk community, I was not sure how to formulate the question precisely, so I give you my use case: Filter for failed user transactions to determine lost revenue and exclude recovered transactions, i.e. from those users, who were able to make a successful transaction at a later point This means that a user can make multiple failed transactions/attempts but if at least one of them was successful, all of the user´s transactions/events should be removed from the results. Example fields and values: userid=ABC transactionsuccess=true/false value=100 I can get the number and total value of all failed transactions using index=myindex transactionsuccess=false | stats sum(value) AS revenueloss | dedup userid and all the successful ones with index=myindex transactionsuccess=true | stats sum(value) AS revenue| dedup userid Now I just need to find out how to join those two queries into one. I could export both results to excel and filter for all failed events by userid which have no corresponding successful event for the same userid to achieve my goal, but I guess there is an easier way to do this directly in Splunk. Thanks, Phil ... View more