index="np_dpa" PROXYNAME="ProcessUBIDeviceFulfillmentCommunication" Application="Datapower" TransactionStatus="FAIL" TransactionDesc="VOUCHER_INVALID" | table PolicyNumber,DeviceFulfillResp, DeviceFulfillErrorVins, CorrelationId, _time | fields - _raw | sort _time
I have this serach which displays the policy number details and its related fields. This is for all the failed transactions (TransactionStatus="FAIL").
As soon as the policy is reprocessed, its transaction status will change to success. I want the panel to exclude those policy numbers where the transaction status is changed.
Using | stats latest(TransactionStatus) by CorrelationId
does not display data ...
Something like this?
index="np_dpa" PROXYNAME="ProcessUBIDeviceFulfillmentCommunication" Application="Datapower" (TransactionStatus="FAIL" OR TransactionStatus="SUCCESS") TransactionDesc="VOUCHER_INVALID"
| stats max(_time) as _time values(PolicyNumber) as PolicyNumber values(DeviceFulfillResp) as DeviceFulfillResp values(DeviceFulfillErrorVins) as DeviceFulfillErrorVins values(TransactionStatus) as TransactionStatus by CorrelationId
| search NOT TransactionStatus="SUCCESS"
| sort _time
That'll load both successes and failures, bunch up all events for an ID, and discard those that have a success.