Hi and thanks for reading in advance,
I have two tables:
I want to find out which events occur in the errors table, but not the successes table.
The particular context is we had an outage, and I'm trying to discover which events were successfully submitted at a later date, and mainly: which events haven't been submitted since the outage.
How would you go about this?
Thanks,
fre
It's going to be something like this, then...
index=foo status=50* OR status=200
| fields status whateverfieldsareuniqueeventid
| eval Result=if(status=200,"Success","Error")
| stats values(Result) by whateverfieldsareuniqueeventid
| where mvcount(Result)=1 AND Result="Error"
It's going to be something like this, then...
index=foo status=50* OR status=200
| fields status whateverfieldsareuniqueeventid
| eval Result=if(status=200,"Success","Error")
| stats values(Result) by whateverfieldsareuniqueeventid
| where mvcount(Result)=1 AND Result="Error"
A sudo code will be like this (RESULT_TYPE_Identifier is field which differentiates errors with success)
(BASE SEARCH ERRORS) OR (BASE SEARCH SUCCESS)
| eval RESULT_TYPE_Identifier=if(like(status,"50%"),"Error","Success")
| stats values(RESULT_TYPE_Identifier) as RESULT_TYPE_Identifier by eventIdentifier_field(s)
| where mvcount(RESULT_TYPE_Identifier)=1 AND RESULT_TYPE_Identifier="Error"
We can give you better suggestions if you could share your actual queries..
Thanks somesoni2,
queries are quite simple, basically:
status=50*
and
status=200
Do you have any unique identifier in your logs, kind of transaction id or event id?