How do I edit my search to filter XML content and only show failed status for a specific node?

I have an XML results input that is indexed on per Test Suite. Each Test Suite has many Test Cases, and each Test Case has many Test Steps. I am trying to create a report where we would like to find out which Test Suite, Case, and Steps failed and what was the error message. However, my search is coming back with all the test case names, and all messages regardless of failure or success. Is there a way to filter out just the failed status for a specific node? Current search: sourcetype=test_suite_result_xml testRunnerResults.testCase.status=FAILED | stats values(testSuiteName) values(testRunnerResults.testCase.testCaseName) values(testRunnerResults.testCase.testStepResults.result.message) by testRunnerResults.testCase.testCaseName Sample XML data: 15:33:18FAILEDUserLifecycleManager399799Failing due to failed test step15:33:18FAILEDf1d9066c-6744-462e-bf76-6eed9b610a5aCreateUser1881[GetApplicationAndBaseUrl] OK: took 279 msGetApplicationAndBaseUrl215:33:18.431OK279[CreateNewUser] FAILED: took 281 ms -> [Valid HTTP Status Codes] Response status code:400 is not in acceptable list of status codesCreateNewUser915:33:20.622FAILED28115:33:21FINISHEDf72a96f9-64f5-4ce4-861a-151e3aadd41fVerifyGroup598[GetApplicationAndBaseUrl] OK: took 256 msGetApplicationAndBaseUrl215:33:21.568OK256