The command is as follows, stats values (session_id) as Session values (_time) as Time values (action) as Action_Performed values (success) as Rate by usage
ay
To try this example on your own Splunk instance, you must download the sample data and follow the instructions to get the tutorial data into Splunk