Hi @fward92, I haven't your data so I cannot test your conditions, but anyway, you can apply the approch of this sample: index=_internal | stats values(source) AS source dc(source) AS dc_source BY user | eval status=if(dc_source=1 OR match(source,"scripted"),"OK","NOK") In few words: if you have only one value you take it, if you have more values you takes the ones that match a word, then you can exclude the "NOK". Ciao. Giuseppe ... View more