I have below log message :
basically it is for creating customer record and if we got error the we are retrying for 5 times to get succeed.
log message-------------
Error while creating record for customer id : 94ABGH0048
Error while creating record for customer id : 94ABGH0048
Successfully created record for customer id : 94ABGH0048
Error while creating record for customer id : 902SDKK720
Successfully created record for customer id : 945TTFK048
can i get those customer id for which record not created Successfully ?
according to above log message output should be "902SDKK720"
1. extract the last status code by customer id I wasn't sure field in your search so used _raw
| rex field=_raw "^(?<statuscode>[a-zA-Z]+)\s|customer\sid\s+:\s(?<customerid>[0-9A-Z]+)"
| stats last(statuscode) by customerid
2. if understanding you correctly; you wanted any customer id's (where the last code is a failure, didn't aks to validate file 5 events but could do that too.
your search blah, blah, blah...
| rex field=_raw "^(?<statuscode>[a-zA-Z]+)\s|customer\sid\s+:\s(?<customerid>[0-9A-Z]+)"
| stats last(statuscode) by customerid
| where statuscode = "Error"
| table customerid