Hi! So ive been at this for hours attempting to use stats and transactions to do this. I have two events that look like the following: Event 1: (date) (connection=1234) (op=#) (BIND) (username=[username]) Event 2: (date) (connection=1234) (op=#) (RESULT) (error=49) (INVALID CREDENTIALS) I want to create a pivot that has it so that usernames and invalid credentials can be grouped... right now I am doing the stats command, but not getting any results because these (username and error=49) are two different events. Unfortunately, these fields do not contain unique values among each other (same connection# is shared with many other events, same op# is shared with many others) The only thing I can think of is event2 comes directly after event1. Is there a way to group this based on time or perhaps eval? Any suggestions? ... View more