We have below log event rows -
correlationKey=abc msg="create cache for 123"
correlationKey=abc "read cache for 123"
correlationKey=mno "create cache for 456"
correlationKey=mno "read cache for 456"
correlationKey=xyz "read cache for 123"
From the data, we may notice that correlationKey abc/mno have both create/read. But for correlationKey xyz, it does not have "create cache" log, but "read cache" only.
We need to find all correlationKey values w/o log entry "create cache for". (abc/mno do not qualify. Only xyz qualify.)
Appreciate your great help!
- ET
| eval created=if(match(msg,"create cache"),"true",null)
| stats values(created) as created by correlationKey
| where NOT created="true"
Appreciate!
Hi @enpingtu,
You could try something like this:
your_search
| eval qualify=case(searchmatch("create cache for"),"Create", searchmatch("read cache for"),"Read"
| stats dc(qualify) AS dc_qualify values(qualify) AS qualify BY correlationKey
| eval status=if(dc_qualify=2,"Qualify","Do not Qualify")
| table correlationKey status
Ciao.
Giuseppe