Hi, We have applications Availability data in splunk. With below SPL, I got this data. Base_SPL..| streamstats reset_on_change=true count as Real_Status by status,JonName The challenge is to identify, if 2 or more successive failure have happened. Only show ALL Fail events, if 2 or more successive failures. In the below table, only the contents highlighted in RED needs to be shown. (Ignore Failure, highlighted in GREEN) If i filter with below SPL, then i will miss the 1st FAIL event (Highlighted in RED)  where Real_Status > 1   So how do I solve this challenge?   JobName status Real_Status Process1 SUCCESS 1 Process1 SUCCESS 2 Process1 FAIL 1 Process1 SUCCESS 1 Process1 FAIL 1 Process1 FAIL 2 Process1 FAIL 3 ... View more