How do you combine info from multiple events but for one customer in one table.

[cspaid75]

How do you combine info from multiple events but for one customer in one table or dashboard? For example:
Event1: Customer = 123456 State=”” Status=”200”

Event2: Customer = 123456 State=”NJ” Status=”500”
Event3: Customer = 123456 State field is missing Status=”400”
Dedup Customer
Where Status=”400”
Table Customer, State
Expected Result:
Customer State
123456 NJ

[richgalloway]

Try this.

index=foo | stats values(*) as * by Customer 
| where mvfind(Status, "400") | table Customer State