I have file processing events with 2 stages - X & Y. I want to get filenames which have gone through X but not Y. I am unable to do so. Could you please advise?
I can list filenames with X stage or Y stage as below
index=test stage=X | stats values(filename)
index=test stage=Y | stats values(filename)
Try like this
index=test stage=X OR stage=Y | stats values(stage) as stages by filename | where mvcount(stages)=1 AND stages="X"
Basically select rows for both stages, generating list of stages each filename has gone through and finally, selecting only events which went though single stage which is "X".
Try like this
index=test stage=X OR stage=Y | stats values(stage) as stages by filename | where mvcount(stages)=1 AND stages="X"
Basically select rows for both stages, generating list of stages each filename has gone through and finally, selecting only events which went though single stage which is "X".