It's going to be something like this, then... index=foo status=50* OR status=200 | fields status whateverfieldsareuniqueeventid | eval Result=if(status=200,"Success","Error") | stats values(Result) by whateverfieldsareuniqueeventid | where mvcount(Result)=1 AND Result="Error" ... View more

Give this a try your current search giving above table with field email, event | replace "deferred" with 1 "processed" with 2 "bounced" with 3 "delivered" with 4 in event | stats max(event) as event by email | replace "1" with "deferred" "2" with "processed" "3" with "bounced" "4" with "delivered" in event ... View more