Need help with a query please: I have ticket data where the life cycle is Assigned, Work in Progress, Fixed, Closed and the ticket is assigned to our group ABC. I want to display only the tickets which are assigned and in progress to our group ABC. My end goal is to show ABC group's ticket count which are not fixed and closed. I have the below query so far: TICKET         STATUS                         GROUP TIC12345   Assigned                        ABC                        Work in Progress         ABC                        Fixed                                DEF                       Closed                              DEF index=* source=* group=ABC | stats latest(status) as l_status latest(group) as l_group by TICKET | search NOT l_status in("Fixed", "Closed") Result: TICKET          STATUS                  GROUP TIC12345  Work in Progress   ABC I was able to get the data however, I'm also getting ticket which are closed(because it is initially assigned to ABC and later it was closed by DEF). Appreciate your help!  ... View more