compare relative data in splunk dashboard panels

[kranthimutyala]

Hi Splunkers,

Im working on Dashboard which has two panels which shows the status of Bots.First panel shows the status of all the bots and second shows the list of unsuccessful bots.My requirement is to show bot in the unsuccessful panel if the latest run of the bot is not successful and if the latest run of the bot is successful then there shouldn't be any entry in the unsuccessful bots panel.Is there any option where we can compare the current status and remove the unsuccessful entries from the below panel. Attached is the screen shot for the reference.Thanks for any help here.

First panel query :  index="abc" (TYPE="Run bot finished" OR TYPE="Run bot Deployed") | $bot$ | $env$ | table _time,BOT_NAME, STATUS

Second Panel query: index="abc" (TYPE="Run bot finished" OR TYPE="Run bot Deployed") STATUS="Unsuccessful" | $bot$ | $env$ | table _time,BOT_NAME,STATUS

[ITWhisperer · Accepted solution]

index="abc" (TYPE="Run bot finished" OR TYPE="Run bot Deployed") | $bot$ | $env$ | stats latest(_time) as _time latest(STATUS) as STATUS by BOT_NAME | where STATUS="Unsuccessful" | table _time,BOT_NAME,STATUS