@appu  I'm not sure but can you please try this? base_query status="success" OR status="interrupt" | bin _time span=30s | stats min(eval(if(status="success",_time,null()))) as success_time max(eval(if(status="interrupt",_time,null()))) as interrupt_time by _time, user_id | where success_time=interrupt_time | stats count by user_id   For playing with sample data. | makeresults | timechart span=5s count | eval count=1 | accum count | eval status=case(count%3==1,"success",count%3==0,"interrupt"),user_id= ceil(count/3) , user_id= ceil(count/100) | rename comment as "Upto Now is sample data only" | bin _time span=30s | stats min(eval(if(status="success",_time,null()))) as success_time max(eval(if(status="interrupt",_time,null()))) as interrupt_time by _time, user_id | where success_time=interrupt_time | stats count by user_id   Thanks KV ▄︻̷̿┻̿═━一 If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more

Hi @bowesmana : I tried the above method with little tweak. Instead of calculating the success and then calculating failure, (sadly, it was not giving any results) so I went ahead and checked for failures and from that I calculated success count. I interchanged null() and Users/UserId. And instead of success I made it as failUsers_Count and failUserId_Count. Which is now giving the required result. Now My only worry is that why it was not giving the result the other way. But, thank you so much for the guidance.   dc(eval(if(log="ERROR", UserId, null())))) as failUserId_Count dc(eval(if(log="ERROR", Users, null()))) failUsers_Count     ... View more