Hi. Subject is confusing so here goes. I have 3 log lines:
org=A Status=Success
org=A Status=Fail
org=B Status=Success
I would like to get stats for orgs that have Status=Success, but not if those orgs have even one log where Status=Fail.
I tried to filter in the search query (but then, I get the line where org=A Status=Success) and in a WHERE clause, with no luck. I'm trying to find the right method to do this kind of filtering.
Thanks!
| stats values(Status) as Status by org
| where NOT Status="Fail"
I assume these are three separate events. You can't filter one event based on value of another event. If you want just a summary of your orgs do something like that
<your base search>
| stats values(Status) by org
| where NOT Status="Fail"
If you want full events use eventstats instead of stats but be aware that eventstats is limited by resource constraints so may not work well on big datasets.
Thanks.
I tried that already, but it still shows the results in the stats.
That's why I said - if you're ok with just the aggregation, use simple stats command. If you want to retain the original events, use eventstats (with the same syntax). Just be warned about the possible performance issues.
I don't need the original events, so I use stats, but it still shows as a line with this values
Right. Forgot to rename the resulting field with stats. See @ITWhisperer 's answer. It is conceptually the same as mine, it's just that he didn't forget to alias the field 🙂 His solution should work. Mine should also work if you replaced the where condition with:
| where NOT 'values(Status)'="Fail"
I tried his and yours with no luck. Lines with the specific attributes still show.
It seems like the information you have provided isn't sufficiently accurate for our suggested solutions to work. Please share more accurate representations of your raw events, preferably in a code block </> to prevent information being lost due to formatting.