Got it to work, I just had to turn off acceleration since we were filtering with WHERE, and search filters can not be applied to accelerated datamodels! Thanks for the help. Below is the finale SPL.
| tstats summariesonly values(Authentication.action) as action,values(Authentication.app) as app,values(Authentication.src) as src,values(Authentication.dest) as dest,values(Authentication.user) as user,values(Authentication.tag) as tag,count from datamodel=Authentication where nodename = Authentication.Privileged_Authentication $constraints$ by _time span=$span$
... View more