status=4 | eval MSGStatus=case(status=1,"CREATED", status=2,"RUNNING", status=3,"CANCELLED", status=4,"Failed", status=5,"PENDING", status=6,"ENDED UNEXPECTEDLY", status=7,"SUCCEEDED",status=8,"STOPPING", status=9,"COMPLETED") |join package_name [inputlookup Azure_VOC.csv] | eval STARTTime=strptime((strftime(now(),"%Y-%m-%d")),"%Y-%m-%d") - strptime(start_time,"%Y-%m-%d")| table Azure_Pipeline_name, MSGStatus, end_time, start_time
query running every 15mins and counting same failure
