Would like to create a query and filter to provide the following information with a single API call...

GIVEN there is an profile defined for an email address

THEN show last X successful logins including Okta Application that issued a token

AND show Timestamp (date and time)

AND reason for failed login, if applicable (e.g. invalid credentials, account lockout, other)

AND total number of successful logins within the last 30 days

AND total number of failed logins within last 30 days

Understood to get the aggregations we would need to sum up events. I am trying to get the log of the specific events that would provide this information, but have not yet succeeded

 I have been using a "q=" with an email and the following filter... (eventType eq "user.session.start" and outcome.result eq "SUCCESS") or (EventType eq "app.oauth2.as.token.grant.id_token") - urlencoded, of course, but have not seen how to get the Application display names