How to write a search to find which tablets have a latest status of Error or Corrupted?

[tenyang]

Hi all,

I have an event sent with the information if a tablet downloaded app successfully or not. If it faces problem, the label shows (AppCorrupted OR Error), but some of them can automatically fix this issue. Fox example, for a tablet called ABC, if AppCorrupted occurred at 11 AM, but it is up at 12 PM, then it would send a new event as event2 below label="AppDownloaded".

Currently my search can only count the total times "Error" or "AppCorrupted", but what I want is get the latest tablet name which is still down. In the previous example, tablet ABC should not be shown as it has been up already.

Please kindly guide me how to fix this problem, thanks in advance.

Event 1:

Jun 05 2015 10:35:47 action="AppDownloaded" category="TabletSystem" geoloc_city="Beijing" geoloc_country="China" label="Error" mount_description="WM-SM-F3" mount_id="651" mount_name="WuMart-Shi-Men F3 石门店 F3" mount_tags="" router_count="0" shop_id="f9ed04cf07c443258e53d25d97b6e285" shop_name="WuMart-Shi-Men" shop_tags="WuMart-Shi-Men, xwalk-library, Tablet-PIPO, With_PowerPoint, WuMart, WM-SM, Pilot-Apr2015, MassRebootTarget, Install_Grp7, Beijing, LIVE, District-Shun-Yi-Qu, ABTest-HnS-Exposed, Hypermarket, China" timezone_id="Asia/Shanghai" timezone_offset="28800000" value="22689566" 

Event 2:

Jun 05 2015 08:56:58 action="AppDownloaded" category="TabletSystem" geoloc_city="Singapore" geoloc_country="Singapore" label="AppDownloaded" mount_description="FP-BNA MountLocation-Dairy-Products" mount_id="779" mount_name="Fairprice Bedok North F2" mount_tags="MountLocation-Dairy-Products" router_count="0" shop_description="Blk 212 Bedok Nth St 1 #01-147 (460212)" shop_id="a4bba643726a4b3992eaba42e6413c19" shop_name="Fairprice Bedok North (BNA)" shop_tags="Tablet-FUGU, Supermarket, Install_May2015, xwalk-library, Singapore, Fairprice-Bedok-North, Campaign-Shared, MassRebootTarget, LIVE, Fairprice" timezone_id="Asia/Singapore" timezone_offset="28800000" value="-7750" 

My search:

LIVE category="TabletSystem" (AppCorrupted OR Error) |stats count by mount_name

[woodcock · Accepted solution]

This will do it:

LIVE category="TabletSystem" (AppCorrupted OR Error OR AppDownloaded) |stats latest(label) by mount_name | where label != "AppDownloaded"

[tenyang]

Thanks so much Woodcock, it is really helps.

Best Regards
Ten