We have some overnight jobs that run and log out to Splunk. On top of this, we have a dashboard which groups by the job id and extracts information like start time, end time, duration etc. The query looks a bit like this: index=foo | stats range(_time) as duration by job-id | table job-id duration We now want to add a status column to tell us if the job completed or had an error. If any of the events in a grouping have a log level of ERROR it should show Error , otherwise it should show Ok . I've tried this snippet: eval status=if(in(level, "ERROR"), "Error", "Ok") Which is fine for evaluating on each event, but I want the grouping to show either Error or Ok depending on values in the the level field for each group. Is this possible in Splunk, and how should I write the query? ... View more