New comment on reddit

Does something like this achieve what you're trying to find?

sourcetype=projects | stats latest(project_id) as project_id by project_partner_1, project_partner_2 event results | stats count by project_id project_partner_1, project_partner_2, event, results 

September 02, 2020 at 02:26PM
via reddit https://www.reddit.com/r/Splunk/comments/il9o4o/need_to_take_particular_results_of_the_first/g3r0en0?utm_source=ifttt