If I understand you correctly, like this:
source=tcp:5544 STAT_VE="YES" OR STAT_VE="NO" |eval Transac=case(D_LAB_ERR="TIMEOUT_REACHED" OR D_LAB_ERR="TIMEOUT_REACHED_RECORD","PA Pb fin de session 3D Secure", SD_STAT_PA="NO" AND (NOT D_LAB_ERR="TIMEOUT_REACHED" OR NOT D_LAB_ERR="TIMEOUT_REACHED_RECORD"),"PA Pb Autres",STAT_VE="NO","VE No",STAT_VE="YES" AND SD_STAT_PA="YES","PA Yes",STAT_VE="YES" AND SD_STAT_PA="ATTEMPT","PA Attempt",STAT_VE="YES" AND SD_STAT_PA="NO", "PA No",STAT_VE="YES","VE sans PA") |stats count by PURCH_DATE Transac | eventstats sum(count) AS TransacSum BY PURCH_DATE
... View more