I am also new to Splunk, but I will try to help. If you would like to simply count how many times a value for status appears for each value of Environment, you can use: | chart count(Status) by Environment If you want separate categories for each value of status as well, you can try: | chart count over Environment by Status I hope that helps! ... View more