I have tired the following commands to retrieve the results, but it fails. |from datamodel:"Authentication"."Failed _Authentication" | stats values(user) count by (action=failure), src | sort -count or |from datamodel:"Authentication"."Failed _Authentication" | stats values(user) values(src) count by (action=failure) | sort -count And I want to achieve the following results. +-------+--------+-------+ | User | src | count | +-------+--------+-------+ | Mary | IT1001 | 10 | +-------+--------+-------+ | Mary | IT1002 | 6 | +-------+--------+-------+ | Peter | IT2002 | 9 | +-------+--------+-------+ | Alan | IT3003 | 8 | +-------+--------+-------+ Please help me. Thanks. ... View more