@vikashperiwal Based on your question seems like only if value_status in your data is already failed you want to use that value for deriving Overall Status. For other value_status, the Overall Status is determined based on whether you have End Date present in data or not. So try the following eval: | eventstats values(value_status) as status_values by id
| eval Ov_status=case(status_values=="Failed","Failed",
isnotnull(start_time) AND isnull(end_time ),"Inprogress",
isnotnull(start_time) AND isnotnull(end_time ),"Completed",
true(),"Unknown") Following is a run anywhere example based on the details provided: | makeresults
| eval data="xyz.123 2020-07-22 Failed -;xyz.123 2020-07-22 Completed 2020-07-22;abc.321 2020-07-22 Inprogress -;"
| makemv data delim=";"
| mvexpand data
| makemv data delim=" "
| eval id=mvindex(data,0), start_time=mvindex(data,1), value_status=mvindex(data,2), end_time=mvindex(data,3)
| eval end_time=case(end_time!="-",end_time)
| table id start_time end_time value_status
| eventstats values(value_status) as status_values by id
| eval Ov_status=case(match(status_values,"Failed"),"Failed",
isnotnull(start_time) AND isnull(end_time ),"Inprogress",
isnotnull(start_time) AND isnotnull(end_time ),"Completed",
true(),"Unknown")
... View more