Hello There, I am trying to get an overall stats for all the logs with a particular sourcetype, however in some sourcetye a particular event is missing from which i am applying a filter, for an example there are 10 (2 where test from my side, 5 success and 3 fail), if i have to filter out test there is only 1 way i.e. by locator now problem is for 'failure' locator does not get fired, hence if I apply a filter to exclude test, I am not getting stats of Failure as well, can anyone please help me how can i get overall stats by only excluding test and getting insights on both Success and fail? below is the script which i am using. sourcetype=book_resptime (locator!="TST*" OR locator!="TEST*") | | stats count(book_success) AS Book, count(eval(book_success=0)) AS BookFail by connector Thanks ... View more