Hello all, I am attempting to put together a search where I'm taking website status (200=allowed, etc) and breaking it into allowed and denied:   | stats count by user, status, http_method | eval action=if(match(status,"^(2)([0-9]*)$"),"Allowed","Denied") | stats list(action) as Action, list(count) as "Count", sum(count) as total by user http_method | eval "Creds Entered"=if(http_method="POST","Yes","No") | sort - total | fields - total | table user Action Count "Creds Entered"      The issue I'm running into is the field for Action (allowed/denied) is not just populating allowed or denied, but multiples of each: So far I have reviewed the following with no success: https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/MultivalueEvalFunctions https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Multivaluefunctions https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Mvcombine https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Makemv#Description https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Nomv https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Mvexpand https://community.splunk.com/t5/Splunk-Search/Dedup-within-a-MV-field/td-p/34957  https://community.splunk.com/t5/Splunk-Search/dedup-gives-different-result-if-a-table-command-is-used-before/td-p/253021 https://community.splunk.com/t5/Splunk-Search/dedup-results-in-a-table-and-count-them/td-p/40339 Any help would be greatly appreciated. ... View more