What if I don't want to pipe my results, i.e I want each eval to be performed on the entire buffer and not just the subset? For example: eval successful_transitions = case(searchmatch("CASE(ActiveSuccesses)"),"active",searchmatch("CASE(InactiveSuccesses)"),"inactive") | stats count as successes by successful_transitions | eval failed_transitions = case(searchmatch("[active-failure]"),"active",searchmatch("[inactive-failure]"),"inactive") | stats count as failures by failed_transitions Here I want to find, of all the events, How many events are active/inactive successful and how many are active/inactive failed?? Thanks ... View more