index=xxxx source=*xxxxxx* | eval respStatus=case(responseStatus>=500, "ERRORS", responseStatus>=400, "EXCEPTIONS", responseStatus>=200, "SUCCESS" ) | stats avg(responseTime), max(responseTime) by client_id, servicePath, respStatus The above query gives me the output as : I want to bring the respStatus column to split in 3 columns and should looks something like this:     Want my table in this format :  clientID | Service Path | Success count | Error Count | Exception Count | Avg Resp time | Max Resp time ... View more