Since there is no sample data given, assuming you have data as below where string status=<singleDigit>
can occur multiple times and this occurrence might also vary however many times within an event. (The query however works well for events where status=<singleDigit>
phrase occurs same number of times within each event):
aa, status=0 status=0 status=0 status=0 status=0
bb, status=0 status=0 status=1
cc, status=1 status=1
dd, status=0
Then how about trying this one:
your query to return raw events
| rex max_match=0 field=_raw "status=(?<myStatus>\d)\s*"
| mvexpand myStatus
| stats sum(myStatus) as Sum by _raw
| eval new_field=if(Sum=0, "success", "failure")
| table _raw, new_field
Sample snapshot:
Since there is no sample data given, assuming you have data as below where string status=<singleDigit>
can occur multiple times and this occurrence might also vary however many times within an event. (The query however works well for events where status=<singleDigit>
phrase occurs same number of times within each event):
aa, status=0 status=0 status=0 status=0 status=0
bb, status=0 status=0 status=1
cc, status=1 status=1
dd, status=0
Then how about trying this one:
your query to return raw events
| rex max_match=0 field=_raw "status=(?<myStatus>\d)\s*"
| mvexpand myStatus
| stats sum(myStatus) as Sum by _raw
| eval new_field=if(Sum=0, "success", "failure")
| table _raw, new_field
Sample snapshot:
This might work. Use rex command to match status values and create a single multivalue field. Then use eventstats to sum the values of your multivalue field. If the sum of status = 0, set a new_field to "OK". Otherwise, set new_field to "FAILURE". In the search below you can disregard the 'makeresults' and 'eval _raw =' commands. I just add those to generate an example event like yours that I can use. You want REX & EVENTSTATS
| makeresults | EVAL _raw = "status=0 status=0 status=0" | REX max_match=0 field=_raw "status=(?P<status>[0-9])" | EVENTSTATS sum(status) AS status_sum | EVAL new_field=IF(status_sum==0,"OK","FAILURE")