Sorry, I am unsure how to describe what I am looking for using Splunk terminology, and I am sure that is why I am having trouble finding the answer. What I am looking for: User    |  Status   | coun --------------------------------- Mike   |   True       |    2             |   False      |    1 -------------------------------- Loagn |  True      |    4              |   False    |    2   So far my search looks like this: index=logs EventType="logon" | stats values(Status) as Status count by User It is almost there, but in the count column, it combines the count for True and False and only gives a single number. ... View more