You can do with your fields but it'd be way easier if you had it parsed differently. Why do you parse the same entity (user) into two different fields? I'd suggest you parse the user separately and the operation ("a server operator" or  "no longer a server operator"). Then it'd be very simple.   <your search> | eval opcount=if(operation="a server operator",1,-1) | stats sum(opcount) by user | eval finalstate=if(opcount>0,"operator","not operator") | table user finalstate   Of course there's an assumption that all users start with a "clean slate" which is not necessarily true (you'd get different results depending on your timerange) so it's not a very good idea to calculate the state of your system this way ... View more